The Security Target (ST) defines the Information Technology (IT) security requirements for the Oracle Identity Manager 11g Release 2 (OIM). OIM is a software application that is used as a method to centralize the management of the roles and privileges of user accounts within an organization. The TOE is capable of associating certain user attributes (or combinations of user attributes) with different sets of privilege on Operational Environment resources. The TSF can then configure these resources based on this association. The TOE can consume data that already exists in organizational identity stores so the privilege model does not need to be one that is defined by the TOE.
","evaluation_configuration":"\r\n\r\nThe TOE is the Oracle Identity Manager 11g Release 2 software product. The evaluated configuration of the TOE is comprised of the following specifications as described in the table below:
\r\n| \r\n Component \r\n | \r\n\r\n Linux \r\n | \r\n\r\n UNIX \r\n | \r\n
| \r\n Server OS \r\n | \r\n\r\n Oracle Linux 6 UL1+ or \r\nSolaris 11 \r\n | \r\n\r\n Solaris 11 \r\n | \r\n
| \r\n OS Type \r\n | \r\n\r\n 64-bit \r\n | \r\n|
| \r\n Minimum Physical Memory \r\n | \r\n\r\n 4 GB \r\n | \r\n|
| \r\n Minimum Available Memory \r\n | \r\n\r\n 2 GB \r\n | \r\n|
| \r\n Application Server \r\n | \r\n\r\n Oracle WebLogic Server 10g or 11g \r\n | \r\n|
| \r\n Database \r\n | \r\n\r\n Oracle 10g or 11g \r\n | \r\n|
| \r\n Identity Store \r\n | \r\n\r\n Microsoft Active Directory, Oracle Internet Directory (OID), or Oracle Unified Directory (OUD) \r\n | \r\n|
| \r\n Co-Requisite Software \r\n | \r\n\r\n Oracle Access Manager (OAM) 11g \r\n | \r\n
\r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. Oracle Identity Manager 11g Release 2 (OIM) was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 4. The product, when delivered configured as identified in the Oracle Identity Manager 11g Release 2 Supplemental Administrative Guidance for Common Criteria Version 1.0 document satisfies all of the security functional requirements stated in the Oracle Identity Manager 11g Release 2 Security Target, Version 1.0. The evaluation underwent CCEVS Validator review. The evaluation was completed in August 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, (report number CCEVS-VR-VID10589-2015, dated August 28, 2015) prepared by CCEVS.
","environmental_strengths":"\r\n\r\nEnterprise Security Management
\r\nThe primary functionality of the TOE is to maintain the identity and credential lifecycle for organizational users. The TSF can associate various user attributes with the notion of an “identity” such that environmental systems and applications are configured for different users based on this identity. As users enter and leave an organization or change their location, the change will be detected by the TSF and the user permissions will be updated automatically. All updates that connect to an external server are secured using TLS. The TSF relies on an authentication server and data store in the Operational Environment to define its administrators and handle their authentication.
\r\nSecurity Audit
\r\nThe TOE generates audit records of its behavior and administrator activities. Audit data includes date, time, event type, subject identity which is written to a remote database over a secure connection and to the local file system of the server on which the TOE resides.
\r\nCryptographic Support
\r\nThe TOE provides cryptographic capabilities in support of TLS and HTTPS secure communications. Cryptographic capabilities are provided by the FIPS 140-2 validated RSA BSAFE Crypto-J version 5.0 software cryptographic module, certificate #1503.
\r\nIdentification and Authentication
\r\nThe ability to manage the TOE is role-based. When administrators authenticate to the TOE, a session cookie is created by the web server and the administrator’s session is established.
\r\nSecurity Management
\r\nThe TOE is managed by authorized administrators using a web GUI. Administrative privileges are defined by the TSF using identity data that is defined in the Operational Environment and the TOE can also define workflow steps such that administrative activities can be subjected to an approval process.
\r\nProtection of the TSF
\r\nThe TOE ensures that administrator credentials are hashed before being sent to the Operational Environment and does not store cleartext password data in memory. Similarly, the answers to user security questions (used for password recovery) are stored in a hashed format. The TOE also protects secret and private key data.
\r\nTrusted Path/Channels
\r\nThe TOE allows trusted channels to be established between itself and the remote data stores (LDAP, RDBMS) that it interfaces with. These trusted channels are secured using TLS. In addition, the TOE establishes a trusted path between authorized administrators and the TSF using HTTPS for the web GUI.
","features":[]}