Oracle Entitlement Server - Managing Organisations

transcript

The most comprehensive Oracle applications & technology content under one roof

Oracle Entitlement Server

Managing Organizations

What are we here for

• Learn about what OES does• How it might be used to solve problems• Demo maybe

Security

• Specialized area• Brittle security when built in• Difficult to change

The Problems

• Managing access to resources• Governance• Auditing• Accommodating changes

Identity Management

• RBAC• Authentication and Authorization• Latency high response for authorization

OES Overview

Entitlement Server Features

• XACML• Fine Grain Entitlement Management• RBAC• ABAC

XACML and Database

• Database auditing can be done with XACML – Note 1375460.1

• Database security is not currently available• Use database http server to query PEP• Database performance???

Business Problem

• Application has rules• Rules need to change• Are your rules hard coded?• Policy engine provides way to support

Admin Console

• CRUD on policy and objects• Mapping policies to users• Policies• Resources• Entitlements• Roles• Applications

Roles – Role Categories

• Roles – User, developer, manager• Role Categories are tags

Role Hierarchies

• Set up Role Hierarchies • Director -> Manager -> Call Centre Worker• Employee -> Payroll Admin -> Accountant• Role Mapping – Dynamic Assignment

Resources

• Add resources• A resource can be a URL or field on a page • A business object – transfer funds• Authorization Policy to grant or deny• Can the user complete a task• Time based access

Entitlements

• Action that can be performed on a resource• Uses the legal actions defined in parent

resource type• Targets – could be more than one resource

Policy

• Has at least one principal – user, role, Ex or app

• At least one target• Grant/deny permissions • Conditions

Attributes & Functions

• Used in conditions• Attribute can be dynamically assigned a value• Evaluated at run time -perhaps location• Can be multivalued list• Condition builder

Condition Builder

Administration

• Delegated administration• Application Administration• View or manage rights• Policy Domains to delegate• Allows for delegation to specific areas

Questions

• Peter McLarty• Director Turagit Consulting• Chameleon• DBA, Middleware, Architecture• http://www.turagit.com

Oracle Entitlement Server - Managing Organisations

Technology