All about Oracle Security Developer Tools

If I talk about, Oracle Security Developer Tools i.e. OSDT the foremost thing which come into my mind is set of java libraries (JARs) used by developers to secure the enterprise applications. It is one of the SDKs (Software Development Kits) for building up Oracle Platform Security Services (OPSS) and to manage and identify the services, etc. It is delivered as a set of Java libraries that ship with Oracle Application Server and JDeveloper.

Security tools are always treated as critical components for the application development project. The commercial necessities and government regulations convey that sensitive data that need to be kept confidential and protected from being altered. It comes with the cryptographic building blocks which are necessary for basic responsibilities e.g. secure messaging to more complicated projects such as securely implementing a service-oriented architecture.

OSDT architecture

 Image reference:  “http://www.oracle.com/technetwork/testcontent/osdt-133323.pdf”

So what are the business benefits using it?

• Standards-compliant (i.e. Conformance and Validation) – It enables greater control over document display. In this, Java, XML are available.
• It is certified with Oracle’s Crypto Engine FIPS 140-2 Level 1 certification. 
• It is extensible – i.e. Modular architecture, portable, scalable, easily integrated with enterprise applications.
• It is used by several other Oracle products
• It is installed at hundreds of customer sites worldwide since 1996
• Interoperable – Interoperability is the key toward preceding the use of IM in the workplace. OASIS / W3C / LAP events are included in it.
• It is readily available i.e. The OSDT JARs are installed with the Oracle Application Server in ORACLE_HOME (OC4J and WebLogic Server)

OSDT is part of Oracle Platform Security Services (OPSS), which provides an abstraction layer in the form of standards-based APIs that separate the developers from security and identity management of implementation details. OSDT APIs are –

1. Oracle Crypto – It is a pure Java library that offers fundamental cryptography algorithms, including those directed by the National Institute of Standards and Technology (NIST) in their FIPS publications.
2. Oracle Security Engine – It extends Oracle Crypto by offering X.509 based certificate management functions. This component is a superset of Oracle Crypto.
3. Oracle CMS – It implements the IETF Cryptographic Message Syntax (CMS) protocol. CMS defines data protection schemes that allow for secure message envelopes.
4. Oracle XML – In this, security implements the W3C specifications for XML Encryption and XML Signature.
5. Oracle S/MIME – It implements the IETF S/MIME (Secure/Multipurpose Mail Extensions) specifications for secure email.
6. Oracle PKI SDK – It implements the security protocols that are necessary within Public Key Infrastructure implementations (LDAP, OCSP, TSP, and CMP).
7. Oracle Web Services – It provides security to a framework for authentication and authorization using existing security technologies as outlined in the OASIS specification for Web Services Security.
8. Oracle Liberty SDK – It implements the Liberty Alliance Project specifications enabling federated single sign-on between third-party Liberty-compliant applications.
9. Oracle SAML – It provides a framework for the exchange of security credentials amongst disparate systems and applications in an XML based format as outlined in the OASIS specification for the Security Assertions Mark-up Language.
10. Oracle XKMS – It implements the W3C XKMS 2.0 specification providing PKI integration capabilities with Web Services.

You can find more information about this on the oracle website -  http://docs.oracle.com/cd/B14099_19/idmanage.1012/b15975/intro.htm. They have their dedicated documents and articles on specific products and services. If you have any query or if you want add furthermore in it, please put your suggestions and comments in the comment box below. I request you to put your name or initial so that I can address you for the same.