3 Administering Credential Stores

Considerations for Using Credential Store with Hosted Domains

Using credential store with hosted domains requires special considerations since managed servers do not have access to the /protected directory over HTTP in a hosted domain.

These are two options for using credential store with hosted domains:

• The most secure strategy is to copy the cs_store and cs_key files from the domain_home/protected location to an identical location on each managed server accessing the hosted domain. If this default location does not work for your implementation, you can change it by specifying a different path in the Java system properties using: axia.credential.store.url and axia.credential.store.key.url. For example:

  -Daxia.credential.store.url=file:///local_path/cs_store
  -Daxia.credential.store.key.url=file:///local_path/cs_key
  

  This approach requires that the cs_store file be copied to all managed servers every time the credential store files change. When the encryption key is updated, the updated cs_key file must be copied to each of the domain managed servers.

• A ”medium” level security alternative is to copy the cs_key file from domain_home/protected to an identical location on each of the managed servers, and move the cs_store file to the Administration Console domain_home.

  To make this work, you must change the system properties on both the Administration Console and all of the managed servers to specify the new file locations. For example, you could use this system property to start the Administration Console:

  -Daxia.credential.store.url=file:///domain_home/cs_store
  

  And use this system property on each of the managed servers accessing the hosted domain:

  -Daxia.credential.store.url=https://Domain_Post_IP:9000/cs_store
  

  This approach removes the need to manually copy the cs_store file for each credential store update, but still protects the encryption key from being shared over the network.If the encryption key is ever updated, the cs_key file must be copied to each of the domain managed servers again, but this is uncommon.

Moving the Credential Store Key Files

The default /protected location that Service Controller uses for the credential store files is a special area of the domain is that is more secure than most. It is accessible by the Administration Console but not the managed server.

You can move the credential store files to new locations as desired by renaming the credential store path in the System Property.

Changing Credential Store Encryption Settings

This section explains how to change the credential store password storage configuration settings. Table 3-2 lists the default encryption methods and the system properties you use to change them.

To change these settings add these entries to the Oracle_home/ocsb62/admin_server/properties/common.properties file and then restart the domain.:

oracle.axia.credential.store.cipher.algorithm=DES
oracle.axia.credential.store.key.generator.algorithm=RC2
oracle.axia.credential.store.digest.algorithm= 

Table 3-3 lists the types of algorithms to use. See this discussion on Java Cryptography Architecture Standard Algorithm Name Documentation for more information on the encryption algorithms available: http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html.

Backing Up Credential Store files

Ensure that your domains are backed up, which also backs up the credential store files they contain. For more information, see the discussion on backing up your installation in the Service Controller System Administrator's Guide.

Storing or Validating a Credential (Password) in the Credential Store

To add a credential to the credential store:

1. Open the Administration Console and navigate to your feature's credential store tab or subtab.

2. In the Password area of the screen enter the following:

   • A credential key (such as a username) in the Key field.

     You can store any credential that can be read as a string.

   • A password in the Password field.

3. (Optional) Check the One-Way box to restrict the credential to read-only use.

4. Do one of the following:

   • Click Set Password to add the credential to the credential file.

   • Click Validate Password to confirm that this credential already exists in the credential file.

Storing a Keystore in a Credential Store

To add a keystore from a keystore file to a credential store:

1. Open the Administration Console and navigate to your feature's Credential Store tab or subtab.

2. In the Keystore area of the screen, enter the following:

   • The keystore name in the Key field.

   • The keystore password in the KeyStore Password field.

   • The keystore URL in the KeyStore URL field. This is the location of the keystore file.

3. Click the KeyStore button to add the keystore to the credential file.

Verifying that a Credential Exists in a Credential Store

Use these steps to verify whether a credential exists in a credential store file. These steps to not validate the credential.

1. Open the Administration Console and navigate to your feature's Credential Store tab or subtab.

2. In the General area of the screen, enter key name in the Key field

3. Click the Contains Key? button.

Deleting Credentials from the Credential Store

Use the following steps to delete credentials from a credential store.

1. Open the Administration Console and navigate to your feature's Credential Store tab or subtab.

2. In the General area of the screen, enter key name in the Key field

3. Click one of the following buttons:

   • Click the Delete Key button to remove the credential from the credential file

   • Click the Delete All Keys button to remove all credentials in the credential file.

setPassword

Adds a credential (key and authorization) to the Service Controller bundle's credential store file.

Syntax:

void setPassword(@Name("Key") String key, @Name("Password") String password, @Name("One-way") boolean oneWay)

Where:

• Key - The credential key.

• Password - The authorization string to use for the credential.

• one-way | two-way - one-way encrypts the password and prevents it from being decrypted later (most secure). two-way encrypts the password and allows it to be decrypted later.

validatePasssword

Validates credential information against a credential stored in a credential store file. Returns true if the two are identical.

Syntax:

boolean validatePassword(@Name("Key") String key, @Name("Password") String password)

Where:

• Key - The credential key.

• Password - The authorization string to use for the credential.

setKeystore

Obtains a keystore from a keystore file and stores it in a credential store file. Requires a keystore key, password, and the URL of the keystore file.

Syntax:

void setKeystore(@Name("Key") String key, @Name("KeyStore Password") String password, @Name("KeyStore URL") String url)

Where:

• Key - The credential key for the keystore.

• KeyStore Password - The authorization to use for the keystore.

• KeyStore URL - The URL location of the keystore file.

containsKey

Returns true if the key exists in the credential store; false otherwise.

Syntax:

boolean containsKey(@Name("Key") String key)

Where:

• key - The credential key to search for.

deleteKey

Deletes a credential from a credential store file.

Syntax:

void deleteKey(@Name("Key") String key)

Where:

• key - The credential to delete.

clear (Removes all Credentials)

This operation removes all credentials associated with an OSGi bundle from a credential store file.

Syntax:

void clear()