Oracle Entitlements Server uses different Policy Distribution Modes to distribute policies to several Policy Decision Points (PDP) in Security Modules. Policy Management and Policy Distribution are two distinct operations in Oracle Entitlements Server. Policy Administration Point (PAP) is responsible for creation and management of application policies. These policies are stored in Policy Information Point (PIP) which can be an LDAP or database. On evaluating the policies, the grant or deny decision made by PDP is sent to the Policy Enforcement Point (PEP) to enforce the result in application.
In this post, I will talk about the Policy Distribution and the three types of supported Policy Distribution Modes. Policy Administration component of Oracle Entitlements Server lets you define, delete and manage policies in policy store. Policy Distribution Component makes these policies available to the PDP services of configured Security Modules. PDP services evaluate these policies and provides grant or deny result on accessing a protected resource.
The Policy distribution may include one or all of the following actions:
The distribution mode configuration is defined in the jps-config.xml file of the Security Module. Oracle Entitlements Server is responsible for distributing the policies the configured Security Modules. The Policy Data can be distributed in one of the following ways:
The choice of the policy distribution mode depends on the following factors:
Ganesh Kamble works as Oracle Fusion Middleware Consultant and is an Oracle Certified Specialist in Access Management. Having started his career in product development at Oracle, Ganesh got excellent exposure to the middleware technologies during his work in integration of Tier-1 banking product Oracle Banking Platform with Oracle Fusion Middleware products. He was honored with Outstanding Contribution award by Oracle.
His key areas of interest are Oracle Identity and Access Management, Oracle Service Oriented Architecture and Java with passion for blogging on various encounters with Oracle products. He publishes blogs regularly on http://k21technologies.com/blog/. He can be reached at firstname.lastname@example.org and http://twitter.com/ganeshk_8