8 Configuring Oracle Information Rights Management

8.1.2.1 Choosing a Cryptographic Algorithm, Key Size, and Key Store

Due to algorithm restrictions with certain Java Cryptographic Extension (JCE) security providers, a number of different cryptographic algorithms and types of key stores are supported. You should choose the most appropriate cryptographic algorithm, key size, and key store for the target platform. For most platforms, the Advanced Encryption Standard (AES) key wrapping algorithm should be used because it is the stronger encryption algorithm. Other platforms require an RSA key wrapping algorithm.

8.1.2.2 Creating a Key Store

The keytool command will generate a key store, which requires a password to open. Inside the key store, a key, oracle.irm.wrap, will be stored, and access to this key requires an additional password.

To create a key store for Oracle IRM:

1. Run the setWLSEnv script to set the environment:

   • UNIX script: MW_HOME/wlserver_10.3/server/bin/setWLSEnv.sh

   • Windows script: MW_HOME\wlserver_10.3\server\bin\setWLSEnv.cmd

   For the Java and Oracle WebLogic Server tools to work, you should have the weblogic.jar file in the MW_HOME/wlserver_10.3/server/lib or MW_HOME\wlserver_10.3\server\lib directory.

   Setting the environment correctly results in keytool being in the user's PATH environment variable. This setting specifies the directory path to use for the keytool command in the rest of this procedure.

2. Run the keytool utility to generate an Oracle IRM key store.

   • For AES, enter the following keytool command, on a single command line (the key size can be either 128 or 256):

     keytool -genseckey -storetype JCEKS -alias oracle.irm.wrap 
           -keyalg AES -keysize 128 -keystore irm.jceks
     

     When prompted by keytool, choose appropriate passwords for the key store and the generated key.

   • For RSA, enter the following keytool command, on a single command line:

     keytool -genkeypair -alias oracle.irm.wrap 
           -keyalg RSA -keysize 2048 -keystore irm.jks
     

     When prompted by keytool for the certificate details, use the suggested default value, unknown. When prompted for passwords for the key store and the generated key, choose appropriate values.

3. Copy the irm.jceks or irm.jks file to the domain's fmwconfig directory:

   • UNIX path: MW_HOME/user_projects/domains/DomainHome/config/fmwconfig

   • Windows path: MW_HOME\user_projects\domains\DomainHome\config\fmwconfig

8.1.2.3 Setting the Key Store Location

The Oracle IRM server configuration needs to be updated so that it can locate the key store file. You can set the key store location in the server configuration with either Fusion Middleware Control, on the Oracle IRM General Settings page, or with the WebLogic Scripting Tool (WLST) connect and setIRMKeyStore commands.

-Dweblogic.security.SSL.ignoreHostnameVerification=true
-Dweblogic.security.TrustKeyStore=KeyStoreName

The suggested location for the key store is in a directory under the domain home:

• UNIX path: MW_HOME/user_projects/domains/DomainHome/config/fmwconfig

• Windows path: MW_HOME\user_projects\domains\DomainHome\config\fmwconfig

Placing the key store in this location ensures that the key store file is backed up when the domain and corresponding credential store files are backed up.

To set the key store location with Fusion Middleware Control:

1. Start Fusion Middleware Control at the following URL:

   http://adminServerHost:adminServerPort/em
   

   For adminServerHost, specify the name of the computer that hosts the Administration Server for your domain. For adminServerPort, specify the listen port number for the Administration Server. The default number is 7001. For example:

   http://myHost.example.com:7001/em
   

   To log in, supply the user name and password that were specified on the Configure Administrator User Name and Password screen in the configuration wizard.

2. In the farm navigation tree on the left, expand Content Management and Information Rights Management, and then click IRM.

3. From the IRM menu, select Administration and then General Settings.

4. For the key store type, enter one of the following values:

   • JCEKS if you are using an AES key

   • JKS if you are using an RSA key-pair

5. In the Keystore field on the General Settings page, enter one of the following key store paths.

   • Key store path for a JCEKS key store:

     • UNIX path: MW_HOME/user_projects/domains /DomainHome/config/fmwconfig/irm.jceks

     • Windows path: MW_HOME\user_projects\domains \DomainHome\config\fmwconfig\irm.jceks

   • Key store path for a JKS key store:

     • UNIX path: MW_HOME/user_projects/domains /DomainHome/config/fmwconfig/irm.jks

     • Windows path: MW_HOME\user_projects\domains \DomainHome\config\fmwconfig\irm.jks

6. On the General Settings page, you can also specify other settings for Oracle IRM.

7. Click Apply.

To set the key store location with WLST commands:

1. Enter the following WLST commands:

   • UNIX operating system

     ECM_ORACLE_HOME/oracle_common/common/bin/wlst.sh
     connect('username','password','t3://adminServerHost:adminServerPort')
     setIRMKeyStore()
     

   • Windows operating system

     ECM_ORACLE_HOME\oracle_common\common\bin\wlst.cmd
     connect('username','password','t3://adminServerHost:adminServerPort')
     setIRMKeyStore()
     

   For adminServerHost, specify the name of the computer that hosts the Administration Server for your domain. For adminServerPort, specify the listen port number for the Administration Server. The default number is 7001. For example:

   't3://myHost.example.com:7001'
   

   You will be prompted for the key store type and key store path.

2. For the key store type, enter one of the following values:

   • JCEKS if you are using an AES key

   • JKS if you are using an RSA key-pair

3. For the key store path, enter one of the following values.

   • Key store path for an AES key store

     UNIX path: MW_HOME/user_projects/domains /DomainHome/config/fmwconfig/irm.jceks

     Windows path: MW_HOME\user_projects\domains \DomainHome\config\fmwconfig\irm.jceks

   • Key store path for an RSA key store

     UNIX path: MW_HOME/user_projects/domains/DomainHome/config/fmwconfig/irm.jks

     Windows path: MW_HOME\user_projects\domains \DomainHome\config\fmwconfig\irm.jks

8.1.2.4 Adding Key Store Passwords to the Credential Store

You must add passwords for the Oracle IRM key store to the credential store with WLST commands. A key store password and a password for the generated key were set when the key store was created. These passwords are required by the Oracle IRM server.

To add key store passwords to the credential store:

• For an AES key store, enter the following WLST commands:

  • UNIX operating system

    ECM_ORACLE_HOME/oracle_common/common/bin/wlst.sh
    connect('username','password','t3://adminServerHost:adminServerPort')
    createCred("IRM","keystore:irm.jceks","dummy","password")
    createCred("IRM","key:irm.jceks:oracle.irm.wrap","dummy","password")
    

  • Windows operating system

    ECM_ORACLE_HOME\oracle_common\common\bin\wlst.cmd
    connect('username','password','t3://adminServerHost:adminServerPort')
    createCred("IRM","keystore:irm.jceks","dummy","password")
    createCred("IRM","key:irm.jceks:oracle.irm.wrap","dummy","password")
    

  Notes:

  • In the connect command, substitute the correct values for username and password.

  • In the createCred command, substitute for password the password that was used for creating the key and key store.

  • The "dummy" parameter passed to the createCred command is the user name parameter. The key store does not use a user name, so this value is ignored. This is why the value is set as dummy.

  • It is normal for the creatCred command to return the text "Already in Domain Runtime Tree". This text does not signify an error.

• For an RSA key store, enter the following WLST commands:

  • UNIX operating system

    ECM_ORACLE_HOME/oracle_common/common/bin/wlst.sh
    connect('username','password','t3://adminServerHost:adminServerPort')
    createCred("IRM","keystore:irm.jks","dummy","password")
    createCred("IRM","key:irm.jks:oracle.irm.wrap","dummy","password")
    

  • Windows operating system

    ECM_ORACLE_HOME\oracle_common\common\bin\wlst.cmd
    connect('username','password','t3://adminServerHost:adminServerPort')
    createCred("IRM","keystore:irm.jks","dummy","password")
    createCred("IRM","key:irm.jks:oracle.irm.wrap","dummy","password")
    

8.1.2.5 Configuring the Policy and Credential Store

Oracle IRM uses the Credential Store Framework of Oracle Platform Security Services (OPSS) to retrieve passwords for the Oracle IRM key store. There are no specific configuration steps for Oracle IRM if the credential and policy stores are reassociated with an external LDAP authentication provider, as described in Section 4.9, "Reassociating the Identity Store with an External LDAP Authentication Provider."