OAG/OES Integration for Web API Security: skin and guts by Andre Correa
August 15, 2014 Leave a comment
Introduction
When it comes to defining a strategy for web API security, OAG (Oracle API Gateway) and OES (Oracle Entitlements Server) together present a very interesting choice and are a very powerful combination indeed.
In this post we’re going to take a look at what each component brings in (the skin) and then get our hands on actually describing the integration in detail (the guts).
OAG is designed to inspect and act on various types of messages that are delivered to it or just pass through it. It’s usually positioned to be deployed on the DMZ (the De-Militarized Zone) within corporate networks. As such, it can block malicious traffic, authenticate users with a variety of protocols, integrate with anti-virus products, perform message throttling, thus delivering only the good stuff to your intranet servers and also off-loading them, decisively contributing to achieve some IT operational SLAs. More than that, OAG can switch protocols and transform messages. For instance, an organization may have SOAP-based web services and want to expose them as REST without any re-writing. Or implement SAML federation without touching origin systems. Or talk Kerberos or OAuth with clients and speak SAML with back-end servers. Or use it as an FTP server so that incoming files are immediately sent to a processing pipeline. The possibilities are numerous. Having mentioned these few features and examples, it’s not unreasonable to think deploying OAG inside intranets. And that’s not unusual, actually. It is a nice bridge with obvious benefits.
OES is designed to provide fine-grained authorization with externalized policies to client applications. It takes the coding of access decisions away from developers. Besides the obvious security pro, it shortens the change cycle, when a new security policy needs to be deployed. You simply avoid going through all the phases required for re-deploying your application just because of that change. It’s true the new policy needs testing, but that’s nowhere near when compared to what it takes to re-deploy a new application version. The time to market is drastically reduced. Now to the fine-grained part. OES can take a bunch of aspects in consideration when authorizing: the user identity, user roles, user attributes, context information about the request being made (like originating IP address), factors external to the request (like time of day, day of week, etc) and, of course, request data. Those combined makes it a very powerful authorization engine. It’s not coincidence that OES is the component behind OAM’s (Oracle Access Manager) authorization engine.
While OAG itself brings in authorization capabilities, in this field OES offers a much richer model. And if the organization already employs OES elsewhere, integrating it with OAG makes a lot of sense, because we end up with a single and consistent approach for authorization across applications.
Main Article
The Integration
OES basic architecture comprises a server and different client modules, called SMs (Security Modules). The server connects to a repository where policies are physically kept. The SMs are attached to client applications and connect either to OES server or to the repository directly, depending on their configured mode (I will touch up on this later). There are SMs available for Java, RMI, web services, Weblogic server, Websphere, JBoss, MS Sharepoint. When integrating with OAG, a Java SM is used. Despite its core being a C process, OAG forks up a JVM for some of its functions.
The integration hook between OAG and OES is the “OES 11g Authorization” filter, as seen below: Read the complete article here.
For regular information on Oracle SOA Suite become a member in the SOA & BPM Partner Community for registration please visit www.oracle.com/goto/emea/soa (OPN account required) If you need support with your account please contact the Oracle Partner Business Center.
Blog 
Twitter 
LinkedIn ![image[7][2][2][2]](https://paascommunity.com/wp-content/uploads/2013/04/image7222.png?w=20&h=20 "image[7][2][2][2]"){kind=small}
Facebook ![clip_image002[8][4][2][2][2]](https://paascommunity.com/wp-content/uploads/2013/04/clip_image00284222.jpg?w=26&h=23 "clip_image002[8][4][2][2][2]"){kind=small}
Wiki
To reap the benefits of mobility in the enterprise, CIOs will need to deliver reliable services in an environment of constant complexity and change.
This article will provide a live account of the three day Enterprise Mobility conference, hosted by AMIS in Nieuwegein, The Netherlands. Oracle ADF Product Managers Frank Nimphius and Chris Muir are the keynote speakers. They are joined by Willem de Pater, Steven Davelaar and Lancy Silveira from Oracle and Luc Bors, Frank Houweling, Paul Swiggers, Aino Andriessen and Lucas Jellema from AMIS. The presentations and demonstration during this conference cover the next step for most enterprises (with ADF or without): introducing enterprise mobility. Many of the themes currently or shortly relevant to any organization will take center stage: multi device UI, mobility, security, agile & automated software engineering, performance & scalability, user experience, web & mobile oriented architecture and cloud. It will discuss and demonstrate Oracle’s vision and the upcoming generation of products.
When using the Oracle SOA Suite for web service development, chances are that you are also using an Oracle database and that you are at some point in need of a database adapter in one of your SOA composites. If that happens to be the case, you might also encounter the requirement to support multiple composite revisions and keep them as stabile as possible.
Testing services as an atomic entity can be difficult. Especially if these services are part of a call chain or call other services. Often in such cases mock services are developed to reduce test dependencies and exclude services which are not interesting to the specific test case. For example, I’m testing service A. Service A calls service B. I’m not interested in service B (or service B is maintained by another department on which I don’t want to depend). I would mock service B when testing service A in this case. There are several methods to create mock services. These methods however are mostly not easily usable by testers since they require developing/coding mock services. Testers would benefit from being able to create their own mock services in order to create different tests for a specific service.
Being able to exchange data among internal applications as well as with external partners and government agencies has always been a difficult task. Lacking a comprehensive integration strategy, many organizations find themselves creating new or customized solutions for each new business challenge. This splintered approach invariably leads to a heterogeneous environment that is difficult to manage and costly to operate – which is why a large percentage of IT budgets are spent on interoperability-related projects. 
For an organization to respond in real-time it needs to acquire or develop systems that can respond in real-time. Such systems need to be able to rapidly determine that a response is required and determine also what the appropriate and relevant response should be – they need to decide when and how to act. These kinds of decision-making systems are known as Decision Management Systems. To ensure that a response is delivered in real-time, more event-centric Decision Management Systems are required.
Much has been said about Oracle SOA Suite 10g (or JCaps) upgrades to 11g and how features map between both versions. There is also plenty of information online about this topic both official and unofficial. It’s not news to many that for example SOA Suite 10g is currently in extended support and product will enter sustaining support by the end of 2014 (I will explain more about what extended and sustaining support means later in the blog). However one fact remains truth: There are still many companies out there running platforms that are (or soon will be) in sustaining support, and that don’t yet have an upgrade strategy. I say this based on my own experience as I am currently helping several customers do exactly this.
PaaS Community Blog 