Go to primary content
Application Integration Architecture: Agile PLM PIP for Oracle E-Business Suite Security Guide
Release 3.6
E88838-03
  Go To Table Of Contents
Contents

Previous
Previous
 
 

3 Security Implementation for Agile PIP for EBiz

This chapter gives a general picture of PIP security, and describes how PIP security interacts with Agile and Ebiz Web Services.

3.1 Overview of PIP Security

The AIA framework provides the following methods to secure the service-to-service interaction:

  • Identify clients through authentication.

  • Secure messages through encryption.

  • Avoid message tampering with digital signatures.

  • Encrypt the channel through SSL.

Figure 3-1 High-level Security Architecture

Surrounding text describes Figure 3-1 .

Agile PIP for EBiz 3.6 is shipped with this security implemented, except SSL, which needs manual configuration. OWSM already helps PIP to implement the security methods, and OWSM provides multiple policies to protect web services. The following sections focus on which policies are used in Agile PIP for Ebiz, and how to operate with Agile/Ebiz security.

3.2 PIP Security Policy

Since PIP is based on the AIA framework, all AIA policies can be used by PIP. The following is a list of policies which are used in Agile PIP for EBiz:

  • Global Service Policy applied:

    oracle/aia_wss_saml_or_username_token_service_policy_OPT_ON - This is a cloned copy of oracle/wss_saml_or_username_token_service_policy with Local Optimization set to ON. This is needed for local optimization to work when both client and service composites are co-located.

  • Global Service Client Policy applied:

    oracle/aia_wss10_saml_token_client_policy_OPT_ON

  • Other Service Policies applied:

    • oracle/aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON - This is a cloned copy of oracle/wss_saml_or_username_token_service_policy with Local Optimization set to ON and HTTP basic authentication added as an additional option. Clients such as ODI that do not have the infrastructure to use web services security can call this service using HTTP basic authentication.

    • oracle/no_authentication_service_policy - The oracle/no_authentication_service_policy policy is to those services that do not need authentication.

  • Other Service Client Policies applied:

    • oracle/aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON

    • oracle/aia_wss10_saml_token_client_policy_OPT_ON

    • oracle/wss_username_token_client_policy

    • oracle/wss_http_token_client_policy

3.3 Interoperability with Agile Web Service Security

Agile 9.3.4, 9.3.5 and 9.3.6 provide a tool to enable security for Web Services in running time. Refer to the Agile Product Lifecycle Management Security Guide and follow the steps to enable/disable the security for Agile PLM web services.

When interacting with an Agile web service that is enabled for WS-security, you must add a security header in the SOAP header with all the information needed for security functions. Based on the security of the Agile service, you must add information for any combination of authentication, encryption and integrity. The following table lists the certified policies:

Table 3-1 Certified Policies

Composite Name Service Name Certified Policies

ProcessEngineeringChangeOrderAgileReqABCSImpl

ChangeABSService

TableService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

ProcessItemListInitialLoadAgileABF

BusinessObjectService

ItemABSService

TableService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

SyncBillOfMaterialsConfigurationListAgileProvABCSImpl

ConfiguratorTerminationService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

UpdateEngineeringChangeOrderListAgileProvABCSImpl

ChangeABSService

ChangeStatusService

MergeABSService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

UpdateItemBalanceListAgileProvABCSImpl

ItemABSService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

UpdateItemListAgileProvABCSImpl

ItemABSService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy

ValidateEngineeringChangeOrderListAgileReqABCSImpl

ChangeABSService

TableService

oracle/wss_http_token_client_policy

oracle/wss_username_token_over_ssl_client_policy



Note:

The out-of-box policy for Agile web services is oracle/wss_http_token_client_policy. If you are running Agile PLM in a non-Web Services Security environment, the Web Services Security Configurator does not need to be run. For more detailed steps, refer to the Oracle AIA Agile PLM for Oracle EBS: Design to Release Install Guide.

3.4 Interoperability with Ebiz

When interacting with an EBiz web service that is enabled for WS-security, you must add a security header in the SOAP header with all the information needed for security functions. Based on the security of the EBiz service, you must add information for any combination of authentication, encryption and integrity. The following table lists the certified policies:

Table 3-2 Certified Policies

Composite Name Service Name Certified Policies

GenerateItemNumberService

GenerateItemNumberService

oracle/wss_username_token_client_policy



Note:

The out-of-box policy for EBiz web services is oracle/ wss_username_token_client_policy.

3.5 WSS Configurator

The Web Services Security (WSS) Configurator integrates the Design to Release: Agile - EBS pre-built integration with the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security environment. If you are running Agile PLM in a non-WSS environment, the Web Services Security Configurator does not need to be run.

3.5.1 Starting the Web Services Security Configurator

After you install the Agile PLM PIP, the Web Services Security Configurator files are located in the $SERVICES_LOCATION/pips/AgileToEbiz/Tool directory.

Make sure that the WebLogic Server is started and that the WebLogic console is accessible before running the configurator tool.

To start the Web Services Security Configurator:

  1. Open a Command Prompt window.

  2. Make sure the JAVA_HOME and WLS_HOME environment variables point to the correct locations.

  3. Change to the $SERVICES_LOCATION/pips/AgileToEbiz/Tool directory.

  4. Open the wssconfig-d2rpip file and update the value of the wlstlocation variable, based on the example path in the file.

  5. Run the wssconfig-d2rpip script.

3.5.2 Using the Web Services Security Configurator

When the Web Services Security Configurator initializes, you have the option to review your current security policy, to support the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security policy, or to restore the security policy to the default policy (oracle/wss_http_token_client_policy).

For more information on the Agile PLM 9.3.6 /Agile PLM 9.3.5 /Agile PLM 9.3.4 security policy, see the Agile Product Lifecycle Management Security Guide.

Web Services Security Configurator

3.5.3 Viewing the Current Web Services Security Policy

To view the current web services security policy:

  1. Enter 1 at the prompt.

  2. Enter your SOA server URL, username, and password ad the designated prompts.


    Note:

    If you are running a standalone server, the SOA server URL should be the URL of the Admin Server. If you are running a cluster environment, the SOA server URL should be the URL of one of the Managed SOA servers.

  3. Press Enter

The current web services security policy displays and the configurator tool closes. If you need to update or rollback your security policy, you must restart the tool.

3.5.4 Updating to the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 Security Policy

Enter option 2 on the Web Services Security Configurator to update your security policy to the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 policy (oracle/wss_username_token_over_ssl_client_policy). After enter the required information, the updated policy is attached and the endpoint address is updated for the related web services.

Sample Output when Updating the Security Policy

You can validate the updated policy with Oracle Enterprise Manager.

3.5.5 Restoring Web Services Security Policy

If there is a need to restore the default web services security policy (oracle/wss_http_ token_client_policy), enter option 3 on the Web Services Security Configurator. After entering the required information, the default policy is attached and the endpoint address is updated for the related web services. Sample output when restoring the default security policy

3.5.6 Using MDS to Switch Agile Protocol

To use MDS to Switch the Agile Protocol:

  1. Download the Configuration File from MDS.

  2. Update $DOMAIN_ LOCATION/soa/aia/MDSUtils/DownloadMetaDataFileDP.xml content:

    <?xml version="1.0" standalone="yes"?>
    <DeploymentPlan>
    <Configurations>
    <DownloadMetadataFile downloadLocation="${env.DOMAIN_ LOCATION}/soa/aia/bin/" fileToDownload = "/soa/configuration/default/AIAConfigurationProperties.xml" wlserver="fp" />
    </Configurations>
    </DeploymentPlan>
     
    source <DOMAIN_LOCATION>/soa/aia/bin/aiaenv.sh
    ant -f $SOA_HOME/aiafp/Install/AID/AIAInstallDriver.xml
    -DPropertiesFile=$DOMAIN_LOCATION/soa/aia/bin/AIAInstallProperties.xml
    -DDeploymentPlan=$DOMAIN_LOCATION/soa/aia/MDSUtils/DownloadMetaDataFileDP.xml
    
  3. Update AIAConfigurationProperties.xml and AIAInstallProperties.xml in

    $DOMAIN_LOCATION/soa/aia/bin.

    • If you are updating to the Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 security policy with web service security configurator:

      • In /properties/participatingapplicatons/agile of AIAInstallProperties.xml, update port to https port and update protocol to https.

      • In AIAConfigurationProperties.xml, replace all Agile URLs from http to https. Fourteen (14) locations should be replaced.

    • If you are restoring the web service security policy with Web Service Security Configurator:

      • In /properties/participatingapplicatons/agile of AIAInstallProperties.xml, update port to http port and update protocol to http.

      • In AIAConfigurationProperties.xml, replace all Agile URLs from https to http. Fourteen (14) locations should be replaced.

  4. Upload into MDS.

  5. 5. Update $DOMAIN_LOCATION/soa/aia/MDSUtils/UpdateMetaDataFileDP.xml content:

    <?xml version="1.0" standalone="yes"?>
    <DeploymentPlan>
    <Configurations>
    <UpdateMetadataFile wlserver="fp" mdslocation="apps/AIAMetaData/config">
    <fileset dir="${env.DOMAIN_LOCATION}/soa/aia/bin">
    <include name="AIAInstallProperties.xml" />
    </fileset>
    </UpdateMetadataFile>
    <UpdateMetadataFile wlserver="fp" mdslocation="/soa/configuration/default">
    <fileset dir="${env.DOMAIN_LOCATION}/soa/aia/bin">
    <include name="AIAConfigurationProperties.xml" />
    </fileset>
    </UpdateMetadataFile>
    </Configurations>
    </DeploymentPlan>
     
    source <DOMAIN_LOCATION>/soa/aia/bin/aiaenv.sh 
    cd $DOMAIN_LOCATION/soa/aia/MDSUtils/
    ant -f $SOA_HOME/aiafp/Install/AID/AIAInstallDriver.xml
    -DPropertiesFile=$DOMAIN_LOCATION/soa/aia/bin/AIAInstallProperties.xml
    -DDeploymentPlan=$DOMAIN_LOCATION/soa/aia/MDSUtils/UpdateMetaDataFileDP.xml
    

3.5.7 Setting the SSL Environment

Setting the SSL Environment

After updating the security policy, you must set the SSL environment between Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4 and the Design to Release: Agile - EBS pre-built Integration. For more information on installing Agile PLM 9.3.6/Agile PLM 9.3.5/Agile PLM 9.3.4, see Agile Product Lifecycle Management Application Installation Guide, Release 9.3.6/Release 9.3.5/Release 9.3.4.

Here's an example of how to set the SSL environment between Agile PLM 9.3.6 and the Design to Release PIP with self-signed certificates.

To set the SSL environment for Agile PLM:

  1. Create a directory named agile-keystore936 on the machine where the WebLogic files are located.

  2. Change to the newly created directory and run the following command to create the agile-keystore.jks file:

    keytool -genkey -keyalg RSA -alias ssl -keystore agile-keystore.jks -keysize 2048
    -storepass <password>
    
  3. Enter the following information for the key generation command:

    CN=<Weblogic hostname>, OU=<organizationUnit>, O=<organizationName>, L=<localityName>, ST=<stateName>, C=<countryName>

  4. Run the following command to create and export the SSL certificate, agile-ssl-cert: <password> -alias ssl

    keytool -export -file agile-ssl-cert.cer keystore agile-keystore.jks -storepass
    <password> -alias ssl
    
  5. Run the following command to import the SSL certificate and create the Trust store:

    keytool -import -file agile-ssl-cert.cer keystore agile-trust-store.jks -storepass<password>
    
  6. In a web browser, go to http://<Weblogic_hostname:portnumber>/console to open the WebLogic Console.

  7. In the left pane of the Console, select Environment>Servers, then click the Server name on the right pane.

  8. From ServerName>Configuration>General, check SSL Listen Port Enabled.The default port is 7002.

  9. Select Configuration>Keystores, choose Custom Identity and Custom Trust.

  10. In the Identity section, define the following attributes for the identity keystore:

    • Custom Identity Keystore: (Windows example) C:\agile-keystore-936\agile-keystore.jks

    • Custom Identity Keystore Type: JKS

    • Custom Identity Keystore Passphrase: <password>

  11. In the Trust section, define the following properties for the trust keystore:

    • Custom Trust Keystore: (Windows example) C:\agile-keystore-936\agile-trust-store.jks

    • Custom Trust Keystore Type: JKS

    • Custom Trust Keystore Passphrase: <password>

  12. Activate the changes in the WebLogic Console.

  13. Connect to the Agile PLM system.

    After you have configured SSL on the Agile PLM system, you must make the Integration Server trust the Agile Server.

To make the Integration server trust the Agile Server:

  1. Open a command prompt window and change to the %MW_ HOME%/wlserver/server/lib directory.

  2. Copy the agile-ssl-cert.cer file from the Agile PLM server to the Integration server.

  3. Run the following command to import agile-ssl-cert.cer in the Integration server's key store using the DemoTrust keystore:

    keytool -import -file agile-ssl-cert.cer -alias a9-ssl-cert -keystore DemoTrust.jks
    -storepass    DemoTrustKeyStorePassPhrase
    
  4. In a web browser, go to http://<Weblogic_hostname:portnumber>/console to open the WebLogic Console.

  5. In the left pane of the Console, select Environment>Servers, then click the Server name on the right pane.

  6. Select Configuration>Keystores, choose Custom Identity and Custom Trust.

  7. In the Trust section, define the following properties for the trust keystore:

    • Custom Trust Keystore:%MW_Home%/wlserver/server/lib/DemoTrust.jks

    • Custom Trust Keystore Type: JKS

    • Custom Trust Keystore Passphrase: DemoTrustKeyStorePassPhrase

  8. Save Changes.