Application Integration Architecture: Agile PLM PIP for Oracle E-Business Suite Security Guide Release 3.6 E88838-03 |
|
![]() Previous |
This chapter gives a general picture of PIP security, and describes how PIP security interacts with Agile and Ebiz Web Services.
The AIA framework provides the following methods to secure the service-to-service interaction:
Identify clients through authentication.
Secure messages through encryption.
Avoid message tampering with digital signatures.
Encrypt the channel through SSL.
Agile PIP for EBiz 3.6 is shipped with this security implemented, except SSL, which needs manual configuration. OWSM already helps PIP to implement the security methods, and OWSM provides multiple policies to protect web services. The following sections focus on which policies are used in Agile PIP for Ebiz, and how to operate with Agile/Ebiz security.
Since PIP is based on the AIA framework, all AIA policies can be used by PIP. The following is a list of policies which are used in Agile PIP for EBiz:
Global Service Policy applied:
oracle/aia_wss_saml_or_username_token_service_policy_OPT_ON - This is a cloned copy of oracle/wss_saml_or_username_token_service_policy with Local Optimization set to ON. This is needed for local optimization to work when both client and service composites are co-located.
Global Service Client Policy applied:
oracle/aia_wss10_saml_token_client_policy_OPT_ON
Other Service Policies applied:
oracle/aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON - This is a cloned copy of oracle/wss_saml_or_username_token_service_policy with Local Optimization set to ON and HTTP basic authentication added as an additional option. Clients such as ODI that do not have the infrastructure to use web services security can call this service using HTTP basic authentication.
oracle/no_authentication_service_policy - The oracle/no_authentication_service_policy policy is to those services that do not need authentication.
Other Service Client Policies applied:
oracle/aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON
oracle/aia_wss10_saml_token_client_policy_OPT_ON
oracle/wss_username_token_client_policy
oracle/wss_http_token_client_policy
Agile 9.3.4, 9.3.5 and 9.3.6 provide a tool to enable security for Web Services in running time. Refer to the Agile Product Lifecycle Management Security Guide and follow the steps to enable/disable the security for Agile PLM web services.
When interacting with an Agile web service that is enabled for WS-security, you must add a security header in the SOAP header with all the information needed for security functions. Based on the security of the Agile service, you must add information for any combination of authentication, encryption and integrity. The following table lists the certified policies:
Table 3-1 Certified Policies
Composite Name | Service Name | Certified Policies |
---|---|---|
ProcessEngineeringChangeOrderAgileReqABCSImpl |
ChangeABSService TableService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
ProcessItemListInitialLoadAgileABF |
BusinessObjectService ItemABSService TableService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
SyncBillOfMaterialsConfigurationListAgileProvABCSImpl |
ConfiguratorTerminationService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
UpdateEngineeringChangeOrderListAgileProvABCSImpl |
ChangeABSService ChangeStatusService MergeABSService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
UpdateItemBalanceListAgileProvABCSImpl |
ItemABSService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
UpdateItemListAgileProvABCSImpl |
ItemABSService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
ValidateEngineeringChangeOrderListAgileReqABCSImpl |
ChangeABSService TableService |
oracle/wss_http_token_client_policy oracle/wss_username_token_over_ssl_client_policy |
Note: The out-of-box policy for Agile web services is oracle/wss_http_token_client_policy. If you are running Agile PLM in a non-Web Services Security environment, the Web Services Security Configurator does not need to be run. For more detailed steps, refer to the Oracle AIA Agile PLM for Oracle EBS: Design to Release Install Guide. |
When interacting with an EBiz web service that is enabled for WS-security, you must add a security header in the SOAP header with all the information needed for security functions. Based on the security of the EBiz service, you must add information for any combination of authentication, encryption and integrity. The following table lists the certified policies:
Table 3-2 Certified Policies
Composite Name | Service Name | Certified Policies |
---|---|---|
GenerateItemNumberService |
GenerateItemNumberService |
oracle/wss_username_token_client_policy |
Note: The out-of-box policy for EBiz web services is oracle/ wss_username_token_client_policy. |
The Web Services Security (WSS) Configurator integrates the Design to Release: Agile - EBS pre-built integration with the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security environment. If you are running Agile PLM in a non-WSS environment, the Web Services Security Configurator does not need to be run.
After you install the Agile PLM PIP, the Web Services Security Configurator files are located in the $SERVICES_LOCATION/pips/AgileToEbiz/Tool directory.
Make sure that the WebLogic Server is started and that the WebLogic console is accessible before running the configurator tool.
To start the Web Services Security Configurator:
Open a Command Prompt window.
Make sure the JAVA_HOME and WLS_HOME environment variables point to the correct locations.
Change to the $SERVICES_LOCATION/pips/AgileToEbiz/Tool directory.
Open the wssconfig-d2rpip file and update the value of the wlstlocation variable, based on the example path in the file.
Run the wssconfig-d2rpip script.
When the Web Services Security Configurator initializes, you have the option to review your current security policy, to support the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security policy, or to restore the security policy to the default policy (oracle/wss_http_token_client_policy).
For more information on the Agile PLM 9.3.6 /Agile PLM 9.3.5 /Agile PLM 9.3.4 security policy, see the Agile Product Lifecycle Management Security Guide.
To view the current web services security policy:
Enter 1 at the prompt.
Enter your SOA server URL, username, and password ad the designated prompts.
Note: If you are running a standalone server, the SOA server URL should be the URL of the Admin Server. If you are running a cluster environment, the SOA server URL should be the URL of one of the Managed SOA servers. |
Press Enter
The current web services security policy displays and the configurator tool closes. If you need to update or rollback your security policy, you must restart the tool.
Enter option 2 on the Web Services Security Configurator to update your security policy to the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 policy (oracle/wss_username_token_over_ssl_client_policy). After enter the required information, the updated policy is attached and the endpoint address is updated for the related web services.
You can validate the updated policy with Oracle Enterprise Manager.
If there is a need to restore the default web services security policy (oracle/wss_http_ token_client_policy), enter option 3 on the Web Services Security Configurator. After entering the required information, the default policy is attached and the endpoint address is updated for the related web services.
To use MDS to Switch the Agile Protocol:
Download the Configuration File from MDS.
Update $DOMAIN_ LOCATION/soa/aia/MDSUtils/DownloadMetaDataFileDP.xml content:
<?xml version="1.0" standalone="yes"?> <DeploymentPlan> <Configurations> <DownloadMetadataFile downloadLocation="${env.DOMAIN_ LOCATION}/soa/aia/bin/" fileToDownload = "/soa/configuration/default/AIAConfigurationProperties.xml" wlserver="fp" /> </Configurations> </DeploymentPlan> source <DOMAIN_LOCATION>/soa/aia/bin/aiaenv.sh ant -f $SOA_HOME/aiafp/Install/AID/AIAInstallDriver.xml -DPropertiesFile=$DOMAIN_LOCATION/soa/aia/bin/AIAInstallProperties.xml -DDeploymentPlan=$DOMAIN_LOCATION/soa/aia/MDSUtils/DownloadMetaDataFileDP.xml
Update AIAConfigurationProperties.xml and AIAInstallProperties.xml in
$DOMAIN_LOCATION/soa/aia/bin.
If you are updating to the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security policy with web service security configurator:
In /properties/participatingapplicatons/agile of AIAInstallProperties.xml, update port to https port and update protocol to https.
In AIAConfigurationProperties.xml, replace all Agile URLs from http to https. Fourteen (14) locations should be replaced.
If you are restoring the web service security policy with Web Service Security Configurator:
In /properties/participatingapplicatons/agile of AIAInstallProperties.xml, update port to http port and update protocol to http.
In AIAConfigurationProperties.xml, replace all Agile URLs from https to http. Fourteen (14) locations should be replaced.
Upload into MDS.
5. Update $DOMAIN_LOCATION/soa/aia/MDSUtils/UpdateMetaDataFileDP.xml content:
<?xml version="1.0" standalone="yes"?> <DeploymentPlan> <Configurations> <UpdateMetadataFile wlserver="fp" mdslocation="apps/AIAMetaData/config"> <fileset dir="${env.DOMAIN_LOCATION}/soa/aia/bin"> <include name="AIAInstallProperties.xml" /> </fileset> </UpdateMetadataFile> <UpdateMetadataFile wlserver="fp" mdslocation="/soa/configuration/default"> <fileset dir="${env.DOMAIN_LOCATION}/soa/aia/bin"> <include name="AIAConfigurationProperties.xml" /> </fileset> </UpdateMetadataFile> </Configurations> </DeploymentPlan> source <DOMAIN_LOCATION>/soa/aia/bin/aiaenv.sh cd $DOMAIN_LOCATION/soa/aia/MDSUtils/ ant -f $SOA_HOME/aiafp/Install/AID/AIAInstallDriver.xml -DPropertiesFile=$DOMAIN_LOCATION/soa/aia/bin/AIAInstallProperties.xml -DDeploymentPlan=$DOMAIN_LOCATION/soa/aia/MDSUtils/UpdateMetaDataFileDP.xml
Setting the SSL Environment
After updating the security policy, you must set the SSL environment between Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 and the Design to Release: Agile - EBS pre-built Integration. For more information on installing Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4, see Agile Product Lifecycle Management Application Installation Guide, Release 9.3.6/Release 9.3.5/Release 9.3.4.
Here's an example of how to set the SSL environment between Agile PLM 9.3.6 and the Design to Release PIP with self-signed certificates.
To set the SSL environment for Agile PLM:
Create a directory named agile-keystore936 on the machine where the WebLogic files are located.
Change to the newly created directory and run the following command to create the agile-keystore.jks file:
keytool -genkey -keyalg RSA -alias ssl -keystore agile-keystore.jks -keysize 2048 -storepass <password>
Enter the following information for the key generation command:
CN=<Weblogic hostname>, OU=<organizationUnit>, O=<organizationName>, L=<localityName>, ST=<stateName>, C=<countryName>
Run the following command to create and export the SSL certificate, agile-ssl-cert: <password> -alias ssl
keytool -export -file agile-ssl-cert.cer keystore agile-keystore.jks -storepass <password> -alias ssl
Run the following command to import the SSL certificate and create the Trust store:
keytool -import -file agile-ssl-cert.cer keystore agile-trust-store.jks -storepass<password>
In a web browser, go to http://<Weblogic_hostname:portnumber>/console to open the WebLogic Console.
In the left pane of the Console, select Environment>Servers, then click the Server name on the right pane.
From ServerName>Configuration>General, check SSL Listen Port Enabled.The default port is 7002.
Select Configuration>Keystores, choose Custom Identity and Custom Trust.
In the Identity section, define the following attributes for the identity keystore:
Custom Identity Keystore: (Windows example) C:\agile-keystore-936\agile-keystore.jks
Custom Identity Keystore Type: JKS
Custom Identity Keystore Passphrase: <password>
In the Trust section, define the following properties for the trust keystore:
Custom Trust Keystore: (Windows example) C:\agile-keystore-936\agile-trust-store.jks
Custom Trust Keystore Type: JKS
Custom Trust Keystore Passphrase: <password>
Activate the changes in the WebLogic Console.
Connect to the Agile PLM system.
After you have configured SSL on the Agile PLM system, you must make the Integration Server trust the Agile Server.
To make the Integration server trust the Agile Server:
Open a command prompt window and change to the %MW_ HOME%/wlserver/server/lib directory.
Copy the agile-ssl-cert.cer file from the Agile PLM server to the Integration server.
Run the following command to import agile-ssl-cert.cer in the Integration server's key store using the DemoTrust keystore:
keytool -import -file agile-ssl-cert.cer -alias a9-ssl-cert -keystore DemoTrust.jks -storepass DemoTrustKeyStorePassPhrase
In a web browser, go to http://<Weblogic_hostname:portnumber>/console to open the WebLogic Console.
In the left pane of the Console, select Environment>Servers, then click the Server name on the right pane.
Select Configuration>Keystores, choose Custom Identity and Custom Trust.
In the Trust section, define the following properties for the trust keystore:
Custom Trust Keystore:%MW_Home%/wlserver/server/lib/DemoTrust.jks
Custom Trust Keystore Type: JKS
Custom Trust Keystore Passphrase: DemoTrustKeyStorePassPhrase
Save Changes.