Gotcha! Implementing Security Layers - Applied SOA Patterns on the Oracle Platform - page 461

The following are the Access Management products:
• Oracle Access Manager (OAM) : This is a Web Access Management (WAM)
product that enables SSO across an organization's web presence.
• Oracle Adaptive Access Manager (OAAM) : This enables organizations to ap-
ply stronger, risk-based, and multifactor access control to an organization's web
presence.
• Oracle Identity Federation (OIF) : This provides standards-based identity feder-
ation capabilities to enable SSO across websites.
• Oracle Security Token Service (OSTS ): This is a WS-Trust compliant STS im-
plementation. An STS converts security tokens of various types, enabling com-
patibility and trust across federation boundaries.
• Oracle Entitlements Server (OES) : This is a fine-grained entitlements service
that supports various externalized authorization mechanisms including XACML
3.0.
• Oracle Enterprise Single Sign-On (OeSSO) : This is a client-based SSO product
that enables users to access web, client-server, and legacy applications through a
single, strong authentication wallet for authentication.
Directory services products
Indisputably, Oracle is one of the leaders in directory product offerings (LDAP director-
ies). The Oracle Internet Directory (OID) was the first product in this group and now,
we have a highly efficient Oracle Unified Directory (OUD) , which includes both a
highly scalable LDAP directory service based on Java and a Oracle Virtual Directory
(OVD) product. OUD comes with the following three main components:
• Directory Server
• Proxy Server
• Replication Server
The Directory Server essentially is a highly scalable and top-performing LDAP. The
Proxy Server contributes to LDAP's high-performance proxy requests and responses and
the Replication Server is responsible for the data replication from one OUD to another.
This list of products is just an indication that Oracle has everything necessary for the
proper implementation of all eight SOA security patterns. Now it is your responsibility to
enforce the security of your services by addressing error handling vulnerabilities (these
are what makes your services leak and opens the door for injection-type attacks).