Oracle Label Security provides a set of command-line tools for using Oracle Internet Directory.
Topics:
When you use Oracle Label Security with Oracle Internet Directory, security administrators can use certain commands to create and alter label security attributes stored in the directory.
Note:
You can also use the graphical user interface provided by Oracle Enterprise Manager to manage Oracle Label Security. Detailed documentation can be found in Oracle Enterprise Manager help.
The commands perform updates, inserts and deletes of entries in the directory and are implemented through a script named olsadmintool, which you call from $ORACLE_HOME/bin/olsadmintool.
Table C-1 lists all the commands, in categories, with links to their explanations.
Some of these commands replace PL/SQL procedures that are used for the indicated purposes when Oracle Label Security is used without Oracle Internet Directory. Sites already using Oracle Label Security that add Oracle Internet Directory must replace the use of those PL/SQL procedures by switching to use these new commands instead.
Table C-1 Oracle Label Security Commands in Categories
| Command Category | Command | Replaces PL/SQL Statement |
|---|---|---|
|
Policies |
|
|
|
|
||
|
|
||
|
None; new |
||
|
None; new |
||
|
Levels in a Policy |
|
|
|
|
||
|
|
||
|
Groups in a Policy |
|
|
|
|
||
|
|
||
|
|
||
|
Compartments in a Policy |
|
|
|
|
||
|
|
||
|
Data Labels |
|
|
|
|
||
|
|
||
|
Users |
None; new |
|
|
|
||
|
Profiles |
Replaces the use of several methods. 1 |
|
|
None; new |
||
|
None; new |
||
|
None; new |
||
|
Policy Administrators |
None; new |
|
|
None; new |
||
|
Auditing |
|
|
|
|
||
|
Help |
None; new |
You can use the olsadmintool commands to perform various tasks, such as adding enterprise users to administrative groups for an Oracle Label Security policy.
You must run olsadmintool from the command line.
In the olsadmintool commands, some parameters are optional, which is indicated by enclosing such a parameter within brackets. The two most common examples are [ -b admin context ] and [-p port], indicating that it is optional to specify either the administrative context for the command or the port through which to connect to Oracle Internet Directory. (Default port is 389.)
The use of two dashes (--, no space) is required for all parameters other than b, h, p, D, and w, which are preceded by a single dash. The double dash indicates the need to specify the full or long version of the name or parameter being used. If any such name or parameter contains spaces, it must be enclosed by double quotation marks, for example, "this is an extremely long name or parameter."
The olsadmintool addadmin command adds an enterprise user to the administrative group for a policy, so that the user is able to create, modify, or delete the specified policy's metadata.
You must provide the policy name and the new administrator's DN. This group should contain only enterprise users.
Syntax
olsadmintool addadmin --polname policy_name --admindn admin_DN [ -b admin_context] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool addadmin --polname defense --admindn "cn=scott,c=us" -h sales_west -D cn=lbacsys -w bind_password
The olsadmintool addpolcreator command enables the specified user to create policies.
You must provide the DN for the user.
Syntax
olsadmintool addpolcreator --userdn user_DN [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Examples
olsadmintool addpolcreator --userdn "cn=scott" -h sales_west -D cn=lbacsys -w bind_password
The olsadmintool adduser command adds an enterprise user to a profile within a policy.
You must provide the profile and policy names and the user DN.2 Enterprise users are normal Oracle Internet Directory users with the additional capability of connecting to the database. Users added to a profile must be enterprise users.
Syntax
olsadmintool adduser --polname policy_name --profname profile_name --userdn enterprise_user_DN[ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool adduser --polname tradesecret --profname topsales --userdn "cn=perot" -b "cn=EDS" -h ford -p 1890 -D cn=lbacsys -w bind_password
The olsadmintool altercompartment command changes the long name of a compartment.
You must provide the name of the policy, the short name of the compartment, and the new long name of the compartment.
Syntax
olsadmintool altercompartment --polname policy_name --shortname short_compartment_name --longname new_long_compartment_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool altercompartment --polname defense --shortname A --longname "Allied Forces" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool altergroup command changes the long name for a group component or parent group.
You must provide the name of the policy, the short name of the group, and the long name of the group.
Syntax
olsadmintool altergroup --polname policy_name --shortname short_group_name --longname "new_long_group_name" [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool altergroup --polname defense --shortname US --longname "United States of America" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool altergroupparent command changes or removes the parent group of a group.
You must provide the name of the policy, the short name of the group, and either the short name of the parent group or the clearparent flag, but not both.
Syntax
olsadmintool altergroupparent --polname policy_name --shortname short_group_name [--parentname new_parent_group_name ] [--clearparent] --longname "new_long_group_name" [--parentname new_short_group_name ] [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Examples
olsadmintool altergroupparent --polname defense --shortname US --parentname "Earth" -h sales_west -p 5678 -D cn=defense_admin -w bind_password olsadmintool altergroupparent --polname defense --shortname US --clearparent -h sales_west -p 5678 -D cn=defense_admin -w bind_password
The olsadmintool alterlabel command changes the character string defining the label associated with a label tag.
You must provide the policy name, the numeric tag of the label, and the new character string representing the label.
Syntax
olsadmintool alterlabel --polname policy_name --tag tag_number --value new_label_value [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool alterlabel --polname defense --tag 100 --value "TS:A:US" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool alterlevel command changes the long name of a level.
You must provide the name of the policy, the short name of the level, and the new long name of the level.
Syntax
olsadmintool alterlevel --polname policy_name --shortname short_level_name --longname "new_long_level_name" [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool alterlevel --polname defense --shortname TS --longname "VERY TOP SECRET" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool alterpolicy command alters the options of a policy.
You must provide the name of the policy and the new options.
Syntax
olsadmintool alterpolicy --name policy_name --options new_options [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
In this specification:
new_options can be any combination of the following entries: INVERSE_GROUP, HIDE, LABEL_DEFAULT, LABEL_UPDATE, CHECK_CONTROL, READ_CONTROL,WRITE_CONTROL,INSERT_CONTROL, DELETE_CONTROL, UPDATE_CONTROL, ALL_CONTROL, NO_CONTROL
Example
olsadmintool alterpolicy --name defense --options "READ_CONTROL,INSERT_CONTROL" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool olsadmintool audit command sets the audit options for a policy.
You must provide the policy name, the options to be audited, the type of audit, and the type of success to be audited.
Syntax
olsadmintool audit --polname policy_name --options audit_option_name --type audit_option_type --success audit_success_type [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
In this specification:
audit_option can be any combination of the following entries: APPLY, REMOVE, SET, PRIVILEGE
type can be session or access
success can be successful, not successful, or both
Example
olsadmintool audit --polname defense --options "APPLY,PRIVILEGE" --type session --success success -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool createcompartment command creates a new compartment component.
You must provide the name of the policy, the tag numeric value of the compartment, the short name of the compartment, and the long name of the compartment.
Syntax
olsadmintool createcompartment --polname policy_name --tag tag_number --shortname short_compartment_name --longname <"long_compartment_name"> [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool createcompartment --polname defense --tag 100 --shortname A --longname Alpha -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool creategroup command creates a new group component.
You must provide the name of the policy, the tag numeric value of the group, the short name of the group, the long name of the group, and the parent group name (optional).
Syntax
olsadmintool creategroup --polname policy_name --tag tag_number --shortname short_group_name --longname <"long_group_name"> [--parentname parent_group_name] [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool creategroup --polname defense --tag 55 --shortname US --longname "United States" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool createlabel command creates a valid data label.
You must provide the policy name, the numeric tag of the label to be created, and the character string representation of the label.
Syntax
olsadmintool createlabel --polname policy_name --tag tag_number --value label_value [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool createlabel --polname defense --tag 100 --value "TS:A,B:US,CA" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool createlevel command creates a new level component.
You must provide the name of the policy, the tag numeric value, the short name of the level, and the long name of the level.
Syntax
olsadmintool createlevel --polname policy_name --tag tag_number --shortname short_level_name --longname <"long_level_name"> [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool createlevel --polname defense --tag 100 --shortname TS --longname "TOP SECRET" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool createprofile command creates a new profile.
You must provide the policy name, the profile name, and either privileges, labels, or both privileges and labels. (A user profile can have either null label information or null privilege information, but not both null at the same time.) For labels, specify the maximum label users in this profile can use to read data, the maximum label users in this profile can use to write data, the minimum label users in this profile can use to write data, the default label for reading, the default row label for writing. For privileges, enclose in quotation markets list of privileges, separated by commas, for members of this profile.
Syntax
olsadmintool createprofile --polname policy_name --profname profile_name --maxreadlabel max_read_label --maxwritelabel max_write_label --minwritelabel min_read_label --defreadlabel default_read_label --defrowlabel default_row_label --privileges privileges_separated_by_comma [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool createprofile --polname topsecret --profname topsales --maxreadlabel "TS:A,B:US,CA" --maxwritelabel "TS:A,B:US,CA" --minwritelabel "C" --defreadlabel "TS:A,B:US,CA" --defrowlabel "C:A,B:US,CA" --privileges "READ,COMPACCESS,WRITEACROSS" -b EDS -h ford -p 1890 -D cn=lbacsys -w lbacsyspwrd
The olsadmintool createpolicy command creates a policy.
You must provide the name of the policy, the name of its label column, and the options.
Syntax
olsadmintool createpolicy --name policy_name --colname column_name --options options_separated_by_commas [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
In this specification:
new_options can be any combination of the following entries: INVERSE_GROUP, HIDE, LABEL_DEFAULT, LABEL_UPDATE, CHECK_CONTROL, READ_CONTROL, WRITE_CONTROL,INSERT_CONTROL, DELETE_CONTROL, UPDATE_CONTROL, ALL_CONTROL, NO_CONTROL
Example
olsadmintool createpolicy --name defense --colname defense_col --options "READ_CONTROL,UPDATE_CONTROL" -h sales_west -p 389 -D cn=defense_admin -w bind_password
The olsadmintool describeprofile command enables you to see the contents of the specified profile in the specified policy.
You must provide the policy name and the name of the profile.
Syntax
olsadmintool describeprofile --polname policy_name --profname profile_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool describeprofile --polname defense --profname contractors -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool dropadmin command removes an enterprise user from the administrative group of a policy, so that the user is no longer able to create, modify, or delete the specified policy's metadata.
You must provide the policy name and the DN of the administrator to be removed from the administrative group.
Syntax
olsadmintool dropadmin --polname policy_name --admindn admin_DN [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool dropadmin --polname defense --admindn "cn=scott,c=us" -h sales_west -D cn=lbacsys -w bind_password
The olsadmintool dropcompartment command removes a compartment component.
You must provide the name of the policy and the short name of the compartment.
Syntax
olsadmintool dropcompartment --polname policy_name --shortname short_compartment_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool dropcompartment --polname defense --shortname A -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool dropgroup command removes a group component.
You must provide the policy name and the short group name.
Syntax
olsadmintool dropgroup --polname policy_name --shortname short_group_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool dropgroup --polname defense --shortname US -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool droplabel command drops a label from the policy.
You must provide the policy name and the string representation of the label.
Syntax
olsadmintool droplabel --polname policy_name --value label_value -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool droplabel --polname defense --value "TS:A:US" h sales_west -D cn=defense_admin -w bind_password
The olsadmintool droplevel command removes a level component from a specified policy. Provide the name of the policy and the short name of the level.
Syntax
olsadmintool droplevel --polname policy_name --shortname short_level_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool droplevel --polname defense --shortname TS -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool droppolicy command drops a policy.
You must provide the name of the policy to be dropped. For directory-enabled installations of Oracle Label Security, refer to "Subscription of Policies in Directory-Enabled Label Security".
Syntax
olsadmintool droppolicy --name policy_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool droppolicy --name defense -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool dropprofile command removes the specified profile.
You must provide the policy name and the name of the profile to be dropped.
Note:
Dropping a profile removes the authorization on that policy for all the users in the dropped profile. The users will be unable to see data protected by that policy.
Syntax
olsadmintool dropprofile --polname policy_name --profname profile_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool dropprofile --name defense --profname employees -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool droppolcreator command cancels the ability of the specified user to create policies.
You must provide the user's DN.
Syntax
olsadmintool droppolcreator --userdn user_DN [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool droppolcreator --userdn "cn-scott,c=us" -b UA -h sales_west -p 1890 -D bind_DN -w bind_password
The olsadmintool dropuser command drops a user from the specified profile in the specified policy.
You must provide the policy name, the name of the profile, and the DN of the user.
Syntax
olsadmintool dropuser --polname policy_name --profname profile_name --userdn enterprise_user_DN [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool dropuser --polname defense --profname contractors --userdn "cn=hanssen,c=us" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool command_name -- help command enables you to get help information about the specified command.
Syntax
olsadmintool command_name --help
The olsadmintool noaudit command cancels the audit options for a policy.
You must provide the policy name and the options that are no longer to be audited.
Syntax
olsadmintool noaudit --polname policy_name --options audit_option_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
In this specification:
audit_option_name can be any combination of the following entries: APPLY, REMOVE, SET, PRIVILEGE
Example
olsadmintool noaudit --polname defense --options "APPLY,PRIVILEGES" -h sales_west -D cn=defense_admin -w bind_password
The olsadmintool listprofile command to see a list of all profiles in a given policy.
You must provide the policy name.
Syntax
olsadmintool listprofile --polname policy_name [ -b admin_context ] -h OID_host [-p port] -D bind_DN -w bind_password
Example
olsadmintool listprofile --polname defense -b CIA -h sales_west -D cn=defense_admin -w bind_password
All olsadmintool commands must specify connection parameters: the OID host, the bind DN, the bind password, and optionally, the port through which the connection to Oracle Internet Directory is to be made. (The default port is 389.)
All olsadmintool commands may specify, as needed, the subscriber/administrative-context using the -b flag.
The fact that specifying a parameter is optional, such as a port or an administrative context, is shown by enclosing the parameter within brackets. The two most common examples are [ -b admin context] and [-p port].
Because every command must specify a host, bind DN, and password, and may, if needed, also specify an administrative context, Table C-2 uses the abbreviation CON to represent all of these connection parameters as a group:
[ -b admin_context ] h OID_host [-p port] -D bind_DN -w bind_password
Table C-2 summarizes the commands in several categories.
Policies: creating, altering, or dropping policies or their components, that is, levels, groups, and compartments
Data labels: creating, altering, or dropping them
Administrators and policy creators: adding or dropping them
Users: adding or dropping users from a profile
Auditing options: setting the options for what to audit for a policy
Profiles: creating, listing, describing, or dropping them
Default read or row labels: setting them
In Table C-2 and Table C-3, the column headings show only the parameters, not the keywords that must precede them. For example, Table C-2 shows policyname and column-name as parameters for the createpolicy command, without showing the keywords that must precede them (--name and --colname).
Table C-2 explains the individual parameters that are used as column headings in the summaries of Table C-2 and Table C-3.
In all these tables:
X means required, and O means unused or omitted.
OptionsP means policy enforcement options, that is, any combination of the following entries, separated by a comma:
INVERSE_GROUP
HIDE
LABEL_DEFAULT
LABEL_UPDATE
CHECK_CONTROL
READ_CONTROL
WRITE_CONTROL
INSERT_CONTROL
DELETE_CONTROL
UPDATE_CONTROL
ALL_CONTROL
NO_CONTROL
OptionsA means audit options, that is, any comma-separated combination of the following entries: SET, APPLY, REMOVE, or PRIVILEGE.
Table C-2 Summary: olsadmintool Command Parameters
| Command Category | Commands & Parameters | ||||||
|---|---|---|---|---|---|---|---|
|
Policies |
Command |
policy name |
column- name |
optionsP |
CON |
||
|
|
X |
X |
X |
X |
|||
|
|
X |
O |
X |
X |
|||
|
|
X |
O |
O |
X |
|||
|
Within a Policy, Create: |
Command |
policy name |
tag |
short name |
long name |
CON |
parent name |
|
a level |
olsadmintool |
X |
X |
X |
X |
X |
O |
|
a group |
olsadmintool |
X |
X |
X |
X |
X |
[ X ] |
|
a compartment |
|
X |
X |
X |
X |
X |
O |
|
Within a Policy, Alter: |
|||||||
|
a level |
|
X |
O |
u |
u |
u |
O |
|
a group or group parent |
|
X |
O |
X |
X |
X |
O |
|
|
X |
O |
X |
O |
X |
[X] |
|
|
Command |
policy name |
tag |
short name |
long name |
CON |
parent name |
|
|
a compartment |
|
X |
O |
X |
X |
X |
O |
|
Within a Policy, Drop: |
|||||||
|
level |
|
X |
O |
X |
O |
X |
O |
|
group |
|
X |
O |
X |
O |
X |
O |
|
compartment |
|
X |
O |
X |
O |
X |
O |
|
Data Labels |
Command |
policy name |
tag |
value |
CON |
||
|
Create label |
|
X |
X |
X |
X |
||
|
Alter data label |
|
X |
X |
X |
X |
||
|
Drop data label |
|
X |
O |
X |
X |
||
|
Policy Administrators |
Command |
policy name |
userDN |
CON |
|||
|
Add an Admin |
|
X |
X |
X |
|||
|
Drop an Admin |
|
X |
X |
X |
|||
|
Policy Creation |
|
O |
X |
X |
|||
|
|
O |
X |
X |
||||
|
Users |
Command |
policy name |
profile name |
userDN |
CON |
||
|
Add a User |
|
X |
X |
X |
X |
||
|
Drop a User |
|
X |
X |
X |
X |
||
|
Auditing |
|
X |
optionsA |
type |
success |
CON |
|
|
|
X |
X |
X |
X |
X |
||
|
Help on olsadmintool |
|
O |
O |
O |
O |
O |
Table C-3 Summary of Profile and Default Command Parameters
| Profile Action | Profile Command | Policy Name | Profile Name | Max Read Label | Max Write Label | Min Write Label | Def Read Label | Def Row Label | Priv's | CON |
|---|---|---|---|---|---|---|---|---|---|---|
|
Create a Profile3 |
|
X |
X |
X |
X |
X |
X |
X |
X |
X |
|
List Profiles |
|
X |
O |
O |
O |
O |
O |
O |
O |
X |
|
Describe a Profile |
|
X |
X |
O |
O |
O |
O |
O |
O |
X |
|
Drop a Profile |
|
X |
X |
O |
O |
O |
O |
O |
O |
X |
Oracle provides ways of using the olsadmintool commands in typical tasks needed to set up Oracle Label Security in an Oracle Internet Directory environment.
Each command appears in this listing on multiple lines for readability, but in reality, would be given out as a single long string on the command line. The summarized results of carrying out all these commands appear in Results of These Examples, which follows the last example.
Topics:
You can use the olsadmintool addpolcreator command to enable other users to be policy creators.
ORACLE_HOME/bin/olsadmintool addpolcreator --userdn "cn=psmith,c=us" -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=lbacsys,c=us" -w bind_password
You can use the olsadmintool createpolicy command to create policies.
ORACLE_HOME/bin/olsadmintool createpolicy --name Policy1 --colname pol1 --options READ_CONTROL,WRITE_CONTROL -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=psmith,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool createpolicy --name Policy2 --colname pol2 --options READ_CONTROL -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=lbacsys,c=us" -w bind_password
You can use the olsadmintool addadmin command to create policy administrators.
ORACLE_HOME/bin/olsadmintool addadmin --polname Policy1 --admindn "cn=shwong,c=us" -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=psmith,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool addadmin --polname Policy2 --admindn "cn=shwong,c=us" -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=lbacsys,c=us" -w bind_password
You can use the olsadmintool createlevel command to create individual levels.
ORACLE_HOME/bin/olsadmintool createlevel --polname Policy1 --tag 100 --shortname TS --longname "TOP SECRET" -b "ou=Americas,o=Oracle, c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool createlevel --polname Policy1 --tag 99 --shortname S --longname SECRET -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool createlevel --polname Policy1 --tag 98 --shortname U --longname UNCLASSIFIED -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool createcompartment command to create a compartment.
ORACLE_HOME/bin/olsadmintool createcompartment --polname Policy1 --tag 100 --shortname A --longname ALPHA -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool createcompartment --polname Policy1 --tag 99 --shortname B --longname BETA -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool creategroup to create a group.
ORACLE_HOME/bin/olsadmintool creategroup --polname Policy1 --tag 100 --shortname G1 --longname GROUP1 -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool creategroup --polname Policy1 --tag 99 --shortname G2 --longname GROUP2 -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool creategroup --polname Policy1 --tag 98 --shortname G3 --longname GROUP3 -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool createlabel to create a label.
ORACLE_HOME/bin/olsadmintool createlabel --polname Policy1 --tag 100 --value TS:A:G1 -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password ORACLE_HOME/bin/olsadmintool createlabel --polname Policy1 --tag 101 --value TS:A,B:G2 -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool createprofile command to create a profile.
ORACLE_HOME/bin/olsadmintool createprofile --polname Policy1 --profname Profile1 --maxreadlabel TS:A:G1 --maxwritelabel TS:A:G1 --minwritelabel U:: --defreadlabel U:A:G1 --defrowlabel U:A:G1 --privileges WRITEUP,READ -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool adduser command to add a user to a profile.
ORACLE_HOME/bin/olsadmintool adduser --polname Policy1 --profname Profile1 --userdn cn=nina,ou=Asia,o=microsoft,l=seattle,st=WA,c=US -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool adduser command to add another user to a profile.
ORACLE_HOME/bin/olsadmintool adduser --polname Policy1 --profname Profile1 --userdn cn=daniel,ou=France,o=oracle,l=madison,st=WI,c=US -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
You can use the olsadmintool audit command to set audit options in a non-unified auditing environment.
ORACLE_HOME/bin/olsadmintool audit --polname Policy1 --option "SET,APPLY" --type SESSION --success BOTH -b "ou=Americas,o=Oracle,c=US" -h sales_west -p 389 -D "cn=shwong,c=us" -w bind_password
As a result of running the sets of olsadmintool commands outlined, the sample Oracle Label Security site has a specific structure.
Policy creators: User psmith
Policies: Policy1 and Policy2
Policy Administrators: User shwong
Levels, Compartments, and Groups: Refer to Table C-4.
Table C-4 Label Component Definitions from Using olsadmintool Commands
| Label Component | Tag | Short Name | Long Name |
|---|---|---|---|
|
Level |
100 |
TS |
TOP SECRET |
|
99 |
S |
SECRET |
|
|
98 |
U |
UNCLASSIFIED |
|
|
Compartment |
100 |
A |
ALPHA |
|
99 |
B |
BETA |
|
|
Group |
100 |
G1 |
GROUP1 |
|
99 |
G2 |
GROUP2 |
|
|
98 |
G3 |
GROUP3 |
Data labels: Tag 100 for TS:A:G1 and tag 101 for TS:A,B:G2
Users: Nina, from the Asia group of Microsoft, based in Seattle, Washington, managed under the Americas organization of the US Oracle organization, and Daniel, from the France group of Oracle in Madison, Wisconsin, managed under the same organization.
Profiles: Refer to Table C-5.
Table C-5 Contents of Profile1 from Using olsadmintool Commands
| Profile Element | Contents | Long-name Expansion or Meaning |
|---|---|---|
|
MaxReadLabel |
TS:A:G1 |
TOP SECRET:ALPHA:GROUP1 |
|
MaxWriteLabel |
TS:A:G1 |
TOP SECRET:ALPHA:GROUP1 |
|
MinWriteLabel |
U:: |
UNCLASSIFIED (not restricted to any compartments or groups) |
|
DefReadLabel |
U:A:G1 |
UNCLASSIFIED:ALPHA:GROUP1 |
|
DefRowLabel |
U:A:G1 |
UNCLASSIFIED:ALPHA:GROUP1 |
|
Privileges |
WRITE_UP, READ |
User can read any row and raise the level of rows the user writes. |
Auditing options: SET, APPLY, SESSION, and BOTH
Replaces several methods in SA_USER_ADMIN: SET_LEVELS, SET_USER_PRIVILEGES, and SET_DEFAULT_LABEL
Command FootnoteEvery command must include the directory host name, the bind DN, and the bind password. Any command may, as needed, also supply the subscriber administrative context (optional), the directory port number (also optional), or both. See also Table C-2 for additional details on these parameters.
In createprofile, specifying both privileges and labels is not required: a profile can specify labels, privileges, or both.