Raymond K. Ng Technical Lead - JAAS Platform Security Oracle Corporation

Securing J2EE Applications with Oracle Identity Management

Agenda  Application Security Overview  Authentication Requirements  Authorization Requirements  J2EE Security  JAAS  Oracle Strategy

Application Security  Security is a process, not a product or feature – No 100% security  Only as secure as weakest link – Go beyond firewall security – Implement multi-layer security  Considerations – Authentication – Authorization – Accountability/Audit – Secure Transport

Oracle 10 g Security Architecture Single Sign-On Oracle Internet Directory mod_ossl Browser Oracle HTTP Server JAAS Oracle 10 g Containers for J2EE (OC4J) mod_osso Security Infrastructure Layer

Authentication Requirements

Use The Appropriate Mechanism  Username and password  Client certificate  Smart Card  Biometrics

Single Sign-On (SSO)  Why SSO-enable your application? – User Convenience – Security – Cost Reduction  Factors to consider – Integration with infrastructure – Extensible framework

Oracle 10 g Single Sign-On  Centralized authentication for web applications  Multiple authentication options – Username/password – Client certificates – 3 rd party API (Biometrics, Smart Card, etc.)  Single Sign-Off  Multiple application types  Integrated across Oracle 10 g – OID, OC4J/JAAS, Portal, OHS, Wireless, Workflow, UM, Ultrasearch, Personalization, Reports, Forms, Discoverer…

Relevant Standards  HTTP  SSL/X.509  J2EE  JAAS  Java Authentication SPI  SAML  WS-Security  Plus emerging specifications

Authorization Requirements

Choose The Right Authorization Model  Roll Your Own (Application-specific) – Maintenance – Administrative Cost – Inconsistent Authorization Policy => Insecurity  Understand The Relevant Standards – J2EE Security – Java 2 Security – JAAS – JACC

J2EE Security

 Design Principles – Declarative security model  Decouple security logic from application logic  Write once run anywhere (WORA ) – Leverage existing security infrastructure  J2EE Roles – Application Provider – Application Assembler – Application Deployer – System Administrator

J2EE Security: Authentication  Multiple Authentication Methods - Basic, Form, SSL client certificate, etc.  Declarative Security – Deployment descriptors: web.xml, ejb-jar.xml  JSR 196: Java Authentication SPI – J2EE 1.5 – JAAS LoginModule integration  Missing – Single Sign-On support

J2EE Security: Authorization  Protected Resources – Web Resources: URL-patterns – Enterprise Beans: Method permissions  “Role”-based Authorization – Not “Role Based Access Control (RBAC)” – Portability  JSR 115: Integration with Java2/JAAS – Pluggable security (authorization) provider – J2EE security constraints => Java2 permissions

JAAS: Java Authentication and Authorization Service

Java 2 Security  Key Components – Security Policy defines authorization policy – SecurityManager/AccessController is security monitor  Necessary if running any untrusted code in your JVM  Limitations – Code-based security only – No policy management API – File-based implementation doesn’t scale

What is JAAS?  Principal-Based security  Authentication – Pluggable Authentication Module (PAM) framework  Authorization – Extension to Java2 Security Model  Optional Package to JDK 1.3 – JDK 1.4 Core API  J2EE 1.3 Requirement – J2EE 1.4: JACC (JSR 115) – J2EE 1.5: Java Authentication SPI (JSR 196)

Oracle 10 g JAAS Provider  Oracle’s JAAS (Java Authentication and Authorization Services) Implementation, plus Extensions  Integrated with Oracle 10 g SSO and OID  Default Security Provider for Oracle 10 g Containers for J2EE

Oracle 10 g JAAS Provider: User Manager LDAP-based Provider type XML-based Provider type OID repository jazn-data.xml repository JAZNUserManager Oracle 10 g Containers for J2EE

Oracle 10 g JAAS Provider: Authentication  Oracle’s RealmLoginModule Integrated with OC4J Authentication – Declarative model – Integrated with J2EE security model – Integrated with Realm framework for user communities  Support custom JAAS LoginModules – Programmatic and declarative – Integrated with J2EE security model  Option to Use Oracle 10 g Single Sign-On (SSO)

Oracle 10 g JAAS Provider: Authorization  JAAS Authorization – Principal (i.e. user) and code-based policies – Hierarchical, role-based access control (RBAC) – Realm framework to support multiple user communities  Authorization Repository – XML flat-file – Oracle Internet Directory (OID)  3 methods of Management – Oracle Enterprise Manager – JAZN Admintool – Programmatic API

Oracle 10 g JAAS Provider: What’s New  Custom JAAS LoginModules – Leverage any JAAS-compliant LoginModules – Integration with J2EE security model  Performance & Scalability Enhancements  OC4J Integration – Password hiding (data-sources.xml, oc4j-ra.xml)  Tool Integration – JDeveloper / BC4J

Oracle 10 g JAAS Provider: Future Directions  Support for 3 rd party LDAP directories – Default LoginModule certified against AD and SunONE  JACC Provider (JSR 115) – Unified authorization model for managed components  Java Authentication SPI (JSR 196) – Unified authentication model for managed components  Portlet Integration (JSR 168) – J2EE/JAAS authorization model for portlets  Management & Deployment Enhancements – JSR 77 & 88  XML Services Security  Web Services Security

JAAS Up Your J2EE Apps

JAAS Up your J2EE Apps: Putting the Pieces Together  Define your security policy – Enterprise policy:  role hierarchy  user->role assignment  permission->role assignment – Application-specific policy:  authentication method  authorization constraints (“security-roles”)  Deploy your J2EE Application – authentication method – authorization constraints (“security-role-mappings”) – RunAs identity

JAAS Up Your J2EE Apps: SSO-enabling your J2EE Apps  Specify static declarative constraints – in web.xml or ejb-jar.xml  Deploy your J2EE applications – specify JAZN-LDAP UserManager – security-role mappings  OID realms, users and groups  Specify authentication method as SSO – in orion-web.xml: 

JAAS Up Your J2EE Apps: Custom LoginModule Integration  Develop, package & deploy your application as usual  Package & deploy your custom LoginModule – As an independent JAR or as part of your application  Configure your application – Set JAZN property “role.mapping.dynamic” to “true” – Set application classpath as appropriate – Set security role mapping as appropriate  Register your custom LoginModule – Associate your custom LoginModule with your application – JAZN Admintool: “-addloginmodule” option

JAAS Up Your J2EE Apps: Tips & Tricks  JAZN-LDAP – User/group management delegated to DAS – grant RMIPermission to user accessing EJBs  JAZN-LDAP Cache – Tuning parameters: “ldap.cache.*”  Identity Management Realm – SSO integration  External Synchronization – Performance vs. Ease-of-development  Public Group – Authentication only

Oracle Strategy

Distributed Systems Security Reference Architecture Identity & Profile Assertion Services Policy Decision Services Identity Management Infrastructure Identity & Policy Store Protected Resources Authentication Application Authorization Privacy Audit Application Security Services Administration & Provisioning Users

Oracle 10 g Security Solution  Oracle Identity Management Infrastructure for the enterprise  Platform security enabled by Oracle Identity Management  Platform components with high security assurance

Oracle Security Architecture Oracle Internet Directory OracleAS Certificate Authority Directory Integration & Provisioning OracleAS Single Sign-on Delegated Administration Services OracleAS 10g JAAS, WS Security Java2 Permissions.. Oracle E-Business Suite Responsibilities, Roles …. Oracle 10g Enterprise users, VPD, Encryption Label Security Oracle Collaboration Suite Secure Mail, Interpersonal Rights … Access Management Directory Services Provisioning Services External Security Services Oracle Identity Management Oracle 10g Platform Security Bindings OracleAS Portal & Wireless Roles, Privilege Groups … Application Component Security OracleAS 10g JAAS, WS Security Java2 Permissions.. Oracle 10g Enterprise users, VPD, Encryption Label Security OracleAS 10g JAAS, WS Security Java2 Permissions.. Oracle 10g Database Enterprise users, VPD, Encryption Label Security Enterprise Security Infrastructure

Oracle Identity Management Benefits  Enables deployment of all Oracle products out of the box – AS, DB, OCS, eBiz  An enterprise infrastructure that leverages Oracle’s “unbreakable” technology – Reliability, scalability, security, performance  A single point of integration for customer’s existing identity management solutions – Transparent 3 rd party integration for OIM enabled products  Accommodates wide variety of partner solutions and customer deployments – Open, standards-based infrastructure enables integration

What’s Next  Implementing Identity Management at Lawrence Livermore National Labs – ID: – Presentor: Tony Macedo, Computer Scientist, LLNL – Date: Thursday, 9/11 – Time: 3:15 - 4:15 – Location: Moscone Center room 120

A Q & Q U E S T I O N S A N S W E R S

Raymond K. Ng Technical Lead - JAAS Platform Security Oracle Corporation