Integration Guide

Storing and Versioning Policy with Oracle Enterprise Repository

This section describes how to integrate Oracle Entitlements Server with Oracle Enterprise Repository. It includes the following topics:

Overview

You can use Oracle Enterprise Repository to manage OES policy data as OER assets. By integrating OER with OES, you can:

Share policy information between implementers and designers.
Use the OER workflow to manage approval of changes made to OES assets.
Maintain versioning of OES policy. An OES asset can have its version number updated in OER when a change occurs in the policy definition contained within the asset.
Use OER’s advanced categorization, reports and querying of OES assets.

Note:

While the OER console allows direct modification of data in an OES policy asset, it is recommended that policy changes first be made in OES and then imported to OER. See Importing/Exporting Policy Asset Data.

Integration Tasks

To manage OES policies with OER:

Set OER import/export properties as described in Set OER Import and Export Properties.
Import the ALES Policy Asset Type into OER, as described in Import Policy Asset Type into OER.
Manage the ALES Policy Assets as described in Manage Policy Assets.

Set OER Import and Export Properties

Follow these steps to set the required import/export properties in OER:

In the OER console, open the Admin tab.
Select System Settings from the left column.
Under Import / Export and Introspection > Import / Export, set Import/Export Client cmee.importexport.enabled to True.
Under Open API > Common, set Open API Enabled cmee.extframework.enabled to True.
Click Save.

Import Policy Asset Type into OER

The OES Policy asset type must be imported in OER. This asset type defines OES metadata, such as privileges, policy, resources, and resource attributes. Follow these steps:

In the OER console, open the Admin tab.
Select Import Export > Import/Export Client.
In the Import tab’s Select file to import field, navigate to ales32-admin/data/aler and select the appropriate Policy Asset Type zip file. Then click Next twice.

ALES 2.6—ales_policy-asset-type.zipALES 3.0—ales_policy-asset-type-3.0.0.zipOES—ales_policy-asset-type-3.2.0.zip

Open the Assets tab and click Edit/Manage Assets.
In the Asset Editor, select Actions > Manage Types and verify that ALES Policy Asset Type appears in the Type Manager.

Manage Policy Assets

The Asset Editor displays OES Policy Assets in the following tabs:

Overview—Asset name, location, and other general information.
Resources—Name, type, description, attributes, and indicates if it is a virtual resource and/or distribution point.
Authorization Policies—Used to manage authorization policies, actions and action groups.
Role Mapping Policies—Used to manage role policies.
Bindings—SCM name, SSM name, and binding resources of the asset.
Entitlements Data—Information related to identities, identity schema, groups, group attributes, and group memberships.
Administration—OER administration information about the asset.

Versioning OES Assets

OER maintains version information for its assets. OES Policy Assets use version numbers in the format N.N (1.0, for example). When importing Policy Assets into OER for the first time, the version number is set to 1.0. When you subsequently import the same assets, the version number increments by 1. You can also modify the version number of an asset within OER.

Importing/Exporting Policy Asset Data

The policyIX utility can perform imports/exports of policy asset data between OES and OER.

PolicyIX makes use of configuration files for imports/exports with OER. For details, see Import/Export Configuration Files.

For more information about policyIX itself, see PolicyIX in the Administration Reference

Export to OER

To export policy assets directly to OER, run policyIX with the -exportToALER option:

policyIX -exportToALER <config_file>

To export the data to OER using a policy data file:

policyIX -exportToALER <config_file> <file_name>

The structure of policy data files has changed in this release. If <file_name> was generated by an earlier version of policyIX, perform the following steps to add the necessary information to the file before exporting the data to OER:

Use ALES 2.6/3.0 version of policyIX to export data from ALES to a policy data file.
Use the current version of policyIX to import the policy data file into the OES database.
Import the OES Policy Asset Type into OER.
Use policyIX to export the OER data to a policy data file.

Importing to OES

To import directly into OES, use the -importFromALER option:

policyIX -importFromALER <config_file>

To import using a file:

Generate a file that obtains the data from OER:

policyIX -importFromALER <config_file> <file_name>

Import the data from the file:

policyIX -import <config_file> <file_name>

Note: For imports. this version of policyIX supports earlier versions of policy data files.

Import/Export Configuration Files

This section describes the configuration file used for imports/exports between OER and OES. This file uses XML to specify required OER information.

Note:

Further information about the configuration file used with policyIX, see Import/Export Utilities in the Administration Reference guide.

<aler_configuration>

Parent element containing all required <aler_property> elements.

<aler_property>

Specifies the name and value of an OER property using the format:

<aler_property name="<property_name>" value=”<value>”/>

server_version—(Required) Server version (2.6 or 3.0)
server_url—(Required) connection URL
username—(Required) user name for connecting to OER
userPassword—(Required) user password
assetName—(Required) name of the asset
assetDescription—(Optional) Description of the asset
importAssetVersion—(Required) Asset version to import; valid only if the -importFromALER option is used in the policyIX command.

Listing 7-1 provides an example of the OER-related elements in the configuration file:

Listing 7-1 Import/Export Configuration

<aler_configuration> <aler_property name="server_version" value=”3.0”/> <aler_property name="server_url" value=http://123.43.32.3546:7101/aler/services/FlashlineRegistry/> <aler_property name="userName" value="admin"/> <aler_property name="userPassword" value="tan66kds9"/> <aler_property name="assetName" value="MyALESPolicy"/> <aler_property name="assetDescription" value="An ALES Policy asset"/> <aler_property name="importAssetVersion" value="2"/> </aler_configuration>