Skip navigation.
Downloads | Product Documentation | Support

Installing WebLogic Server v8.1 Security Service Module

# Integrating with WebLogic Portal

This section covers the following topics:

- Introduction
- Integration Pre-Requisites
- Integrating with WebLogic Portal

# Introduction

Integrating AquaLogic Enterprise Security with WebLogic Portal server and portal application results in an enhanced set of security services for use in protecting WebLogic Portal (see Figure 5-1). AquaLogic Enterprise Security participates in the authoring and management of policy for WebLogic Portal resources. Once AquaLogic Enterprise Security is integrated with WebLogic Portal, you use AquaLogic Enterprise Security Administration Server to manage resources related to portal desktops, books, pages, and portlets.

Therefore, the intent is that you use AquaLogic Enterprise Security for authorization of the resources associated with a portal application as well as standard WebLogic Server J2EE resources. The benefit of using AquaLogic Enterprise Security to manage visitor entitlements is that it offers fine-grained, dynamic role-based authorization. Additionally, AquaLogic Enterprise Security allows you to have common security policies for a heterogeneous environment. For example, you may have a single security infrastructure that supports WebLogic Portal, WebLogic Server, and custom applications.

The AquaLogic Enterprise Security security service does not replace all of the management functionality provided by the Portal Administration Tools. For example, as shown in Figure 5-1, AquaLogic Enterprise Security is not used to manage administrative users and resources associated with Portal Delegated Administration and Portal Content Management; use the Portal Administration Tools for those management tasks.

Figure 5-1 Portal Integration Overview

AquaLogic Enterprise Security enables you to write, deploy, and manage fine-grained policy for controlling access to WebLogic Portal application resources. You can use AquaLogic Enterprise Security to protect portal desktops, books, pages, portlets, and application look and feels.

For more information, see the following topics:

- Integration Features
- Supported Use-case Scenario
- Constraints and Limitations

## Integration Features

AquaLogic Enterprise Security can be used with either WebLogic Server 8.1 Service Pack 4 or Service Pack 5. While several different security providers can be used with WebLogic Portal, the following security providers include enhanced WebLogic portal support:

- The ASI Authorization provider—Enables you to use AquaLogic Enterprise Security to write, deploy, and manage fine-grained authorization of WebLogic Portal application resources related to desktops, books, pages, portlets, and application look and feels.
- The Database Authentication provider—Enables user and group controls. This provider is integrated into the Portal Administration Tools environment so as to handle user and group queries.

Note: Use of the Database Authentication provider with WebLogic Portal is not mandatory. You may use other authentication providers as well.

- ASI Role Mapper—Enables dynamic mapping of principals (users and groups) to security roles at runtime. Role Mapping determines which security roles to apply to the principals stored in a subject when the subject is attempting to perform an operation on a portal application resource. Because this operation usually involves gaining access to the portal application resource, the ASI Role Mapper is used in conjunction with the ASI Authorization provider.

## Supported Use-case Scenario

The following use-case scenario is supported when you integrate AquaLogic Enterprise Security with WebLogic Portal:

- The AquaLogic Enterprise Security Administration Server assumes responsibility for management and policy of resources related to Portal visitor entitlements.
- The AquaLogic Enterprise Security Administration Server is responsible for management of J2EE application resources associated with Portal applications and portal administration tools.
- The Portal Administration Tools continue to be responsible for the rest of Portal Management and Administration, including the creation and management of portal administrative users and groups.

Note: To implement this use case scenario, you must define the security configuration as specified in Creating the Portal Application Security Configuration.

## Constraints and Limitations

When integrated with AquaLogic Enterprise Security, WebLogic Portal has the following constraints and limitations:

- Portal application administrators will not use the WebLogic Portal Administration Tools to create and manage visitor entitlements.

Use of AquaLogic Enterprise Security with a Portal application implies that an administrator will not use the Portal Administration Tools to create "Visitor Entitlements" on portal desktops, books, pages, and portlets. Managing visitor entitlements from the Portal Administration Tools is not a supported use case.

- Users will not use application deployment descriptors to deploy policy.

Use of Deployment descriptors to deploy policy is not supported in AquaLogic Enterprise Security.

- Migration of existing portal application policy is not supported.

AquaLogic Enterprise Security does not to support the migration of visitor entitlements policy for existing portal applications. There are no facilities for migrating any information from the WebLogic Server embedded LDAP store.

- AquaLogic Enterprise Security does not replace or in any way interfere with the use of the Portal Administration Tools for the management of resource structures associated with Portal Delegated Administration and Portal Content Management.

You cannot use AquaLogic Enterprise Security to manage the resources associated with Portal Delegated Administration and Portal Content Management. AquaLogic Enterprise Security does not support Portal Unified User Profiles.

# Integration Pre-Requisites

Before you begin, you must ensure that the following pre-requisites are satisfied:

- The WebLogic Platform/Portal 8.1, with Service Pack 4 or Service Pack 5, must be installed on the local machine.
- The AquaLogic Enterprise Security WebLogic Server v8.1 Security Service Module, Version 2.1 must be installed on the local machine.
- You must have access to an Administration Console that is running on the AquaLogic Enterprise Security Administration Server, Version 2.1 on either the local machine or a remote machine.
- You have created a WebLogic Portal domain on the local machine and installed a portal application in that domain.

# Integrating with WebLogic Portal

This section describes how to integrate AquaLogic Enterprise Security with WebLogic Portal. Once integrated, you can use the AquaLogic Enterprise Security Administration Console to write and deploy a set of authorization and role mapping policies to protect WebLogic Portal application resources.

Note: While the instructions provided is this section use a WebLogic Portal server and the sample portal application that ships with the WebLogic Platform 8.1 software distribution, you can use this procedure to integrate AquaLogic Enterprise Security with your WebLogic Portal server and portal application.

To integrate AquaLogic Enterprise Security with WebLogic Portal, perform the following tasks:

- Creating the Portal Application Security Configuration
- Binding the Security Configuration
- Distributing the Security Configuration
- Creating an Instance of the Security Service Module
- Enrolling the Instance of the Security Service Module
- Modifying the Portal Server startWeblogic File
- Creating the security.properties File
- Replacing the Portal p13n_ejb.jar File
- Replacing the Portal p13n_system.jar File
- Replacing the DefaultAuthorizerInit.ldift File
- Configuring Policy for the Portal Application
- Discovering Portal Application Resources
- Distributing Policy and Security Configuration
- Starting the WebLogic Portal Server
- Using Portal Administration Tools to Create a Portal Desktop
- Accessing the Portal Application

## Creating the Portal Application Security Configuration

This section describes how to create a new security configuration named `myrealm`. A security configuration defines the set of security providers to use for adjudication, authentication, auditing, authorization, role mapping, and credential mapping services. The security configuration named `myrealm` matches the default security configuration for the WebLogic Portal sample portal application.

Note: To implement the use-case scenario described in Supported Use-case Scenario, you are required to defined the security configuration as described in this section. This security configuration is a requirement; it is not optional.

Refer to Table 5-1 and use the AquaLogic Enterprise Security Administration Server to configure the security providers listed there. Set the Configuration ID to `myrealm`. For instructions on creating a security configuration, see the administration console's help system.

Table 5-1 Portal Security Configuration

Security Provider | Configuration Settings
--- | ---
ASI Adjudication Provider | Uncheck the Require Unanimous Permit check box, and click Create.
Log4j Auditor | Accept the default settings, and click Create.
Database Authentication Provider | Set the Control Flag to `SUFFICIENT,` and click Create. For the Details tab settings, except for the Identity Scope, the parameters are populated automatically. Set the Identity Scope to `myusers`, and click Apply. Note: Even though you set the Identity Scope to `myusers`, you do not actually create the `myusers` identity until you perform the steps in Creating the Realm Resource.
WebLogic Authentication Provider | Set the Control Flag to `SUFFICIENT`, and click Create. Note: Make sure the authentication providers are configured in the following order: 1) Database Authenticator and 2) WebLogic Authenticator. Note: The WebLogic Authentication provider can be replaced with another authentication provider that supports write access to users and groups.
ASI Authorization Provider | On the General tab, accept the default settings, and click Create. On the Details tab, set the Identity Scope to `myusers`, and click Apply.
WebLogic Authorization Provider | Uncheck the Policy Deployment Enabled check box, and click Create.
WebLogic Credential Mapper Provider | Uncheck the Credential Mapping Deployment Enabled check box, and click Create.
ASI Role Mapping Provider | On the General tab, accept the default settings, and click Create. On the Details tab, set the Identity Scope to `myusers`, and click Apply.
WebLogic Role Mapper Provider | Uncheck the Role Deployment Enabled check box, and click Create.

## Binding the Security Configuration

The security configuration must be bound to a Service Control Manager.

To bind the `myrealm` security configuration, see the Console Help

## Distributing the Security Configuration

The `myrealm` security configuration must be distributed.

To distribute the `myrealm` security configuration, see the Console Help.

## Creating an Instance of the Security Service Module

Before starting a WebLogic Server Security Service Module, you must first create an instance of the WebLogic Server 8.1 Security Service Module using the Create New Instance Wizard.

To create an instance of a WebLogic Server 8.1 Security Service Module, see Creating an Instance of the WebLogic 8.1 Security Service Module.

## Enrolling the Instance of the Security Service Module

You must have the Administration Server running prior to enrolling the Security Service Module.

Note: While you can use the demonstration digital certificate in a development environment, you should never use it in a production environment.

To enroll a security service module, see Enrolling the Instance of the Security Service Module.

## Modifying the Portal Server startWeblogic File

Before you can start a WebLogic Portal server that uses BEA AquaLogic Enterprise Security, you must modify the `startWeblogic` file that is located in the WebLogic Portal domain that you are using for you WebLogic Portal server. These modifications are needed so that portal connects the WebLogic Portal domain to the distributed `myrealm` security configuration on startup.

The `startWeblogic` file for the WebLogic Portal domain named `portalDomain` is located at: `BEA_HOME\user_projects\domains\portalDomain`

To edit the `startWeblogic` file, perform the steps:

Note: This procedure assumes a Windows installation of WebLogic Portal in the directory `c:\bea` with an WebLogic Server 8.1 Security Service Module instance named `portalInstance`.

1. Before you modify the script, make sure to make a backup copy. For example, for Microsoft Windows, copy `startWeblogic.cmd` to `startWeblogic.cmd.original`.
2. Add a line to call the environment batch file `set-wls-env.bat`. For example, add it below the line: `set SAVE_JAVA_OPTIONS=`

>     call "c:\bea\ales21-ssm\wls-ssm\instance\portalInstance\bin\set-wls-env.bat"

3. Add the AquaLogic Enterprise Security `classpath` variables to the `classpath`. For example, add the following text before the line: `echo CLASSPATH=%CLASSPATH%`

>     set CLASSPATH=%WLES_PRE_CLASSPATH%;%CLASSPATH%;%WLES_POST_CLASSPATH%

4. Add `%WLES_JAVA_OPTIONS%` to the server start command after `%JAVA_OPTIONS%`. Listing 5-1 shows, in bold text, where to make this change.

Listing 5-1 Adding WLES_JAVA_OPTIONS to the startWebLogic File

>     if "%WLS_REDIRECT_LOG%"=="" (
>           echo Starting WLS with line:
>           echo %JAVA_HOME%\bin\java %JAVA_VM% %MEM_ARGS% %JAVA_OPTIONS% %WLES_JAVA_OPTIONS% -Dweblogic.Name=%SERVER_NAME% -Djava.security.policy=%WL_HOME%\server\lib\weblogic.policy  %PROXY_SETTINGS% %SERVER_CLASS%
>           %JAVA_HOME%\bin\java %JAVA_VM% %MEM_ARGS% %JAVA_OPTIONS% %WLES_JAVA_OPTIONS% -Dweblogic.Name=%SERVER_NAME% -Djava.security.policy=%WL_HOME%\server\lib\weblogic.policy %PROXY_SETTINGS% %SERVER_CLASS%
>     ) else (
>           echo Redirecting output from WLS window to %WLS_REDIRECT_LOG%
>           %JAVA_HOME%\bin\java %JAVA_VM% %MEM_ARGS% %JAVA_OPTIONS% %WLES_JAVA_OPTIONS% -Dweblogic.Name=%SERVER_NAME% -Djava.security.policy=%WL_HOME%\server\lib\weblogic.policy %PROXY_SETTINGS% %SERVER_CLASS%  > "%WLS_REDIRECT_LOG%" 2>&1
>     )

## Creating the security.properties File

Create a text file named `security.properties` and place it in the portal domain directory. You use this file to define the AquaLogic Enterprise Security realm and the default realm. Listing 5-2 shows the content of this file for the realm `myrealm`.

Listing 5-2 security.properties File

>     # AquaLogic Enterprise Security Configuration File
>     #
>     # This file contains AquaLogic Enterprise Security configuration
>     # properties. By default, the AquaLogic Enterprise Security runtime
>     # looks for a property file called 'security.properties' in the
>     # working directory.
>     wles.realm=myrealm
>     wles.default.realm=myrealm

## Replacing the Portal p13n_ejb.jar File

To integrate AquaLogic Enterprise Security with WebLogic Portal, you must replace the `p13n_ejb.jar` file in the top-level portal application directory with the version of that file that is provided in the AquaLogic Enterprise Security software distribution. The AquaLogic Enterprise Security version of `p13n_ejb.jar` is located in `BEA_HOME/`ales21`-ssm/wls-ssm/lib` directory.

Note: BEA AquaLogic Enterprise Security 2.1 includes two versions of p13n_ejb.jar, the WebLogic Server 8.1 SP4 version: p13n_ejb_81SP4.jar, and the SP5 version: p13n_ejb_81SP5.jar. Be sure to use the correct version.

Note: Because these instructions assume that you are using the sample portal application that ships with WebLogic Portal, this procedure instructs you to replace the `p13n_ejb.jar` in the sample portal application. To use a different portal application, replace `p13n_ejb.jar` in that application as well.

To replace `p13n_ejb.jar`, perform the following steps:

1. Rename the portal version of the `p13n_ejb.jar`. For example, rename it to `p13n_ejb.jar.original`. The portal application version of this file is located in `BEA_HOME/weblogic81/samples/portal/portalApp.`
2. Depending on which version of the WebLogic Server 8.1 you are using (SP4 or SP5), copy either `p13n_ejb_81SP4.jar` or `p13n_ejb_81SP5.jar` from `BEA_HOME/ales21-ssm/wls-ssm/lib/` to `BEA_HOME/weblogic81/samples/portal/portalApp` and`rename` it to `p13n_ejb.jar`.

## Replacing the Portal p13n_system.jar File

To integrate AquaLogic Enterprise Security with WebLogic Portal, you must replace the `p13n_system.jar` file in the `BEA_HOME/weblogic81/p13n/lib` directory with the version of that file that is provided in the AquaLogic Enterprise Security software distribution. The AquaLogic Enterprise Security version of this file is located in `BEA_HOME/ales21-ssm/wls-ssm/lib` directory.

Note: BEA AquaLogic Enterprise Security 2.1 includes two versions of `p13n_system.jar`, the WebLogic Server 8.1 SP4 version: `p13n_system_81SP4.jar`, and the SP5 version: `p13n_system_81SP5.jar`. Be sure to use the correct version.

Note: Once you replace `p13n_system.jar` in the `/lib` directory of the WebLogic Platform installation, all portal domains configured for that installation must be AquaLogic Enterprise Security enabled.

To replace `p13n_system.jar`, perform the following steps:

1. Rename the portal version of the `p13n_system.jar`. For example, rename it to `p13n_system.jar.original`. The portal version of this file is located in `BEA_HOME/weblogic81/p13n/lib.`
2. Depending on which version of the WebLogic Server 8.1 you are using (SP4 or SP5), copy either `p13n_system_81SP4.jar` or `p13n_system_81SP5.jar` from `BEA_HOME/ales21-ssm/wls-ssm/lib/` to `BEA_HOME/weblogic81/p13n/lib` and rename it to `p13n_system.jar`.

## Replacing the DefaultAuthorizerInit.ldift File

WebLogic Server 8.1 uses the `DefaultAuthorizerInit.ldift` file to establish access controls for J2EE resources. By default, WebLogic Server allows access to all J2EE resources to users in the `Everyone` role. To protect these resources, WebLogic Server provides the Administration Console and other tools to define security policies.

When using AquaLogic Enterprise Security, there is a need to supersede the WebLogic Server J2EE access controls. The `DefaultAuthorizerInit.ldift` file, provided in the AquaLogic Enterprise Security 2.1 for the WebLogic Server 8.1 Security Service Module, is used for this purpose.

To enable the AquaLogic Enterprise Security `DefaultAuthorizerInit.ldift` file to supersede WebLogic Server access controls for J2EE resources in the sample portal application, perform the following steps:

1. Copy the `DefaultAuthorizer.ldift` file from `BEA_HOME/ales21-ssm\wls-ssm\template\config` to `BEA_HOME/user_projects/domains/mydomain`.
2. If the `/ldap` directory exists at the following location, delete it: `BEA_HOME/user_projects/domains/portalDomain/portalServer`

Note: Because these instructions assume that you are using the sample portal domain that ships with WebLogic Portal, this procedure instructs you to delete the `ldap` directory in the `portalDomain/portalServer` directory. Repeat the above steps for all AquaLogic Enterprise Security enabled portal domains.

## Configuring Policy for the Portal Application

Developing a set of policies typically begins by determining which resources you need to protect and your access control requirements. You then create the identity directory, resources, groups, users, and roles that you will use to write policies to protect those resources. Next you write a set of authorization and role mapping policies to define access control on those resources. Finally, you deploy the set of polices to the WebLogic Server 8.1 Security Service Module that you use to control access to your portal application resources.

AquaLogic Enterprise Security provides two means for writing portal application policy, the Administration Console and the Policy Import Tool. In this section you are directed to use the Administration Console to write policy.

For more information on how to use the Administration Console to write policy, see the Policy Managers Guide and the Console Help.

For instructions on how to use the Policy Import Tool to write and import policy files, see the Importing and Exporting Policy section in the Policy Managers Guide.

This section covers the following topics:

- Creating the Identity Directory and Users
- Configuring Resources and Privilege
- Configuring Resource Privileges
- Creating the Role Mapping Policy
- Creating Authorization Policies
- Policy for Visitor Entitlements to Portal Resources

### Creating the Identity Directory and Users

This section describes how to use the Administration Console to create an identity directory, groups, and users for a portal application.

Note: This procedure uses `myusers` as the name of the Identity directory; however, you can use a different name.

To create the Identity directory and users:

1. In the left pane, click Identity. The Identity page displays the name of each directory available.
2. Click New. The Create Directory dialog box appears.
3. In the Name text box, type `myusers` and click OK. The `myusers` directory appears in the list of Identity directories.
4. In the left pane, click Users. The myusers>Users page displays.
5. Click New. The Create User dialog box appears.
6. Create the users that will visit your portal application.

### Configuring Resources and Privilege

This section describes how to use the Administration Console to define the portal application resources that you will protect using AquaLogic Enterprise Security.

To configure resources, perform the following tasks:

- Creating the Realm Resource
- Creating the Shared Resources
- Creating the Console Resources
- Creating the PortalApp Resources

#### Creating the Realm Resource

Note: `myrealm` is used is this procedure as the realm name because the WebLogic Portal sample portal application exists in the `myrealm` realm. You can choose any realm name for your portal application.

To create a realm resources, perform the following steps:

1. Expand the Resources folder, and click Resources. The Resource page displays.
2. In the Resources page, select the Policy node, and click New. The Create Resource dialog box appears.
3. In the Name text box, enter `myrealm`, select `Binding` from the Type drop-down list box, and click Ok. The `myrealm` resource appears under the Policy node.
4. Select the `myrealm` resource and click Configure. The Configure Resource dialog box appears.
5. From the Type drop-down list box, select Binding Application, check the Distribution Point and Allow Virtual Resources check boxes, and click Ok.
6. Refer to Table 5-2 and modify the configuration of the ASI Authorization provider as described there.

Table 5-2 Portal Security Configuration Modifications

Security Provider | Configuration Settings
--- | ---
ASI Authorization Provider | On the Details tab, set the Application Deployment Parent to `//app/policy/myrealm` and click Apply. On the Bindings tab, from the Bind drop-down menu, select `//app/policy/myrealm`, and click Bind.

#### Creating the Shared Resources

Figure 5-2 shows the shared resources that you must create.

Figure 5-2 shared Resources

To create the `shared` resources, perform the following steps:

1. Select the `myrealm` resource and click New. The Create Resource dialog box appears.
2. In the Name text box, enter `shared`, and click Ok. The `shared` resource appears under `myrealm`.
3. Select the shared resource and click Configure. The Configure Resource dialog box appears.
4. Check the Allow Virtual Resources and click Ok.
5. Click the `shared` resource and click New. The Create Resource dialog box appears.
6. In the Name text box, enter `adm` and click Ok. The `adm` resource appears under the `shared` resource.
7. To configure the `jdbc`, `jndi`, and `svr` resources as shown in Figure 5-2, repeat steps 5 and 6 for each resource.

#### Creating the Console Resources

Figure 5-3 shows the console resources that you must create.

Figure 5-3 console Resources

To create the `console` resources, perform the following steps:

1. Select the `myrealm` resource and click New. The Create Resource dialog box appears.
2. In the Name text box, enter `console`, and click Ok. The `console` resource appears under `myrealm`.
3. To create the `url`, `console`, `login`, `and bea_logo.gif` resources as shown in Figure 5-3, repeat steps 1 and 2 for each resource.
4. Select the `console` resource directly under `myrealm` and click Configure. The Configure Resource dialog box appears.
5. Check the Allow Virtual Resources and click Ok.

#### Creating the PortalApp Resources

Note: This procedure uses`portalApp` as the name of the portal application resource because it is the name of the WebLogic Portal sample portal application. However, you should use the name of your portal application when creating the portal application resource.

Figure 5-4 shows the `portalApp` resources that you must create.

Figure 5-4 PortalApp Resources

To create the `portalApp` resources, perform the following steps:

1. Select the `myrealm` resource and click New. The Create Resource dialog box appears.
2. In the Name text box, enter `portalApp`, and click Ok. The `portalApp` resource appears under `myrealm`.
3. Select the `portalApp` resource and click New. The Create Resource dialog box appears.
4. In the Name text box, enter `ejb` and click Ok. The `ejb` resource appears under the `portalApp` resource.
5. Select the `ejb` resource and click Configure. The Configure Resource dialog box appears.
6. Check the Allow Virtual Resources and click Ok.
7. To configure the `url` resource, repeat steps 5 and 6.
8. Select the `portalApp` resource and click New. The Create Resource dialog box appears.
9. In the Name text box, enter `wlp` and click Ok. The `wlp` resource appears under the `portalApp` resource. Do not configure the `wlp` resource to allow virtual resources.
10. Select the `url` resource and click New. The Create Resource dialog box appears.
11. In the Name text box, enter `portalappadmin` and click Ok. The `portalappadmin` resource appears under the `url`.
12. Repeat steps 10 and 11 to create the remaining resources shown under the portalApp resource in Figure 5-4. Do not configure any of the remaining resources to allow virtual resources.

### Configuring Resource Privileges

This section describes how to use the Administration Console to define portal application privileges.

To create privileges, perform the following steps:

1. Expand the Resources folder in the left pane, and click Privileges. The existing privileges appear in the right pane.
2. Click New. The Create Privilege dialog box appears.
3. In the Privilege Name text box, enter `lookup` and click Ok. The `lookup` privilege appears in the list of privileges.
4. Click New. The Create Privilege dialog box appears.
5. In the Privilege Name text box, enter `reserve` and click Ok. The `reserve` privilege appears in the list of privileges.
6. Click OK.

### Creating the Role Mapping Policy

This section describes how to use the Administration Console to create role mapping policy that will be used to control access to portal application resources.

Table 5-3 lists and describes the role mapping policy that you have to create for the WebLogic Portal domain.

Table 5-3 Portal Application Role Mapping Policy

Role Mapping Policy | Description
--- | ---
`grant(//role/Everyone, //app/policy/myrealm, //sgrp/myusers/allusers/) if true;` | Creates the role mapping policy necessary for the Everyone role to be used in the `myrealm` Identity directory. Note: If you do not create the `Everyone` role mapping policy correctly, none of the policy rules defined in Table 5-4 that use the `Everyone` role will work properly.

To create the role mapping policy, refer to Table 5-3 and perform the following steps:

Caution: If you do not create the `Everyone` role mapping policy correctly, none of the authorization policies defined in Table 5-4 that use the `Everyone` role will work properly.

1. Expand the Policy folder in the left pane, and click Role Mapping Policies. The Role Mapping Policies page appears.
2. Click New. The Create Role Mapping Policy dialog box appears.
3. Select the Grant radio button.
4. Select the Roles tab, select `Everyone` in the Available Roles list box, and click Add.
5. Select the Resources tab, select `myrealm`, and click Add.
6. Select the Policy Subjects tab, select the `allusers` in the list box, click Add, and click Ok.

### Creating Authorization Policies

This section describes how to use the Administration Console to create authorization policies to protect portal application resources.

Table 5-4 lists and describes the authorization policies that you have to create for the WebLogic Portal domain to protect the sample portal application resources.

Table 5-4 Portal Application Authorization Policies

Authorization Policies | Description
--- | ---
`grant(any, //app/policy/myrealm/shared/svr, //role/Admin) if true;` `grant(any, //app/policy/myrealm/shared/adm, //role/Admin) if true;` | Authorization policies for booting the WebLogic Portal server and performing administrative tasks.
`grant(any, //app/policy/myrealm/portalApp/url/ sampleportal, //role/Everyone) if true;` `grant(any, //app/policy/myrealm/portalApp/url/tutorial, //role/Everyone) if true;` `grant(any, //app/policy/myrealm/portalApp/url/welcome.jsp, //role/Everyone) if true;` | Grants permission to those in the role Everyone (includes the anonymous user) to access all of the tutorial and sample portal url resources. This authorization policy creates Portal open by default orientation for these two sample portals.
`grant(GET, //app/policy/myrealm/portalApp/url/ portalappadmin/framework, //role/Everyone) if true;` | Allows unauthenticated users to access images used on the Administration Portal login page.
`grant(any, //app/policy/myrealm/portalApp/url/ portalappadmin, //role/ PortalSystemAdministrator) if true;` | Grants permission for those is the role PortalSystemAdministrator to access the WebLogic Portal Administration url Portal resources
`grant(lookup, //app/policy/myrealm/shared/jndi, //role/Everyone) if true;` | Grants permission for those is the Everyone role to lookup JNDI resources.
`grant(reserve, //app/policy/myrealm/shared/jdbc, //role/Everyone) if true;` | Grants permission for those is the Everyone role to reserve JDBC resources.
`grant(any, //app/policy/myrealm/console, //role/Admin) if true;` | Grants permission for those in the Admin role to access the url resources of the WebLogic Server console.
`grant(GET, //app/policy/myrealm/console/url/console/login/bea_logo.gif, //role/Everyone) if true;` | Grants permission for those in the Everyone role to get access to the bea logo gif image resource in the WebLogic Server console
`grant(any, //app/policy/myrealm/portalApp/ejb, //role/Everyone)` | Initially allows access to all EJB methods.

Perform the following steps create the authorization policies listed in Table 5-4.

1. Expand the Policy folder in the left pane, and click Authorization Policies. The Authorization Policies page appears.
2. Click New. The Create Authorization Policy dialog box appears.
3. Select the Grant radio button.
4. To create the first authorization policy listed in Table 5-4, click the Privileges tab, select the `any` privilege from the Select Privileges from Group list box, and click Add.
5. Click the Resources tab, select the `svr` resource from the Child Resource box and click Add.

Note: If Table 5-4 lists multiple resources for a single privilege and role, you may define all of the resources in one authorization policy.

6. Click the Policy Subjects, select the `Admin` role from the Roles List box, click Add, and click Ok.
7. Repeat steps 4 to 6 for each of the remaining authorization policies listed in Table 5-4.

### Policy for Visitor Entitlements to Portal Resources

Visitor entitlements is a mechanism used by WebLogic Portal for determining who may access the resources in a portal application and what they may do with those resources. AquaLogic Enterprise Security provides a means of defining robust role-based policy for portal resources. The resources that can be entitled within a portal application include:

- desktops
- books
- pages
- portlets
- look and feels

Table 5-5 shows the capabilities of each of these resources:

Table 5-5 Capabilities According to Resource Type

Resource Type | View | Minimize | Maximize | Edit | Remove
--- | --- | --- | --- | --- | ---
Desktop | x |  |  |  |
Book | x | x | x |  |
Page | x |  |  |  |
Portlet | x | x | x | x | x
Look & Feel | x |  |  |  |

The capabilities listed in Table 5-5 are defined as follows:

- View—Determines whether or not the user can see the resource.
- Minimize/Maximize—Determines whether or not the user is able to minimize or maximize the portlet or book. This applies to books within a page, not to the primary book.
- Edit—Determines whether or not the user can edit the resource properties.
- Remove —Determines whether or not the user can remove the portlet from a page.

The following topics provide information on how to use AquaLogic Enterprise Security to configure portal resources:

- Configuring Policy for Desktops
- Configuring Policy for Books
- Configuring Policy for Pages
- Configuring Policy for Portlets
- Configuring Policy for Look and Feels
- Defining Policy for Portlets using Instance ID

#### Configuring Policy for Desktops

A desktop is a view of the portal that the visitor accesses. There can be one or more desktops per portal, so the portal is effectively a container for the desktops. A Desktop is referenced as a resource in AquaLogic Enterprise Security in the following manner:

>     //app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Desktop/samplePortal

where:

`myrealm` is the realm in which the portal application is installed

portalapp is the portal application directory

`sampleportal` is the name of the sample portal application

`samplePortal` is the label definition of the desktop.

If you define an authorization policy at the `samplePortal` level, you can control access at the `samplePortal` desktop level.

Table 5-6 shows an authorization policy that grants the `view` privilege to the `samplePortal` desktop for visitors in the SampleVisitor role.

Table 5-6 SamplePortal Authorization Policy

Effect | Privilege | Resource | Policy Subject
--- | --- | --- | ---
Grant | view | `/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Desktop/samplePortal` | SampleVisitor role

#### Configuring Policy for Books

A book is a collection of pages. A book is referenced as a resource in AquaLogic Enterprise Security in the following manner:

`//app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Book/``book_1`

where `book_1` is the label definition of the book.

If you define an authorization policy at the `book_1` level, you can control access at the book_1 book level.

Table 5-7 shows an authorization policy that grants the `view` privilege to the book_1 book for visitors in the SampleVisitor role.

Table 5-7 Book_1 Authorization Policy

Effect | Privilege | Resource | Policy Subject
--- | --- | --- | ---
Grant | view | `/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Book/``book_1` | SampleVisitor role

#### Configuring Policy for Pages

A page is the primary holder of individual portal elements such as portlets. A page is referenced as a resource in AquaLogic Enterprise Security in the following manner:

>     //app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Page/page_2

where `page_2` is the label definition of the page.

If you define an authorization policy at the `page_2` level, you can control access at the page_2 page level.

Table 5-8 shows an authorization policy that grants the `view` privilege to the page_2 page for visitors in the SampleVisitor role.

Table 5-8 Page_2 Authorization Policy

Effect | Privilege | Resource | Policy Subject
--- | --- | --- | ---
> Grant | view |
>     /myrealm/portalapp/wlp/sampleportal/
>     com_bea_p13n/Page/page_2
| SampleVisitor role

#### Configuring Policy for Portlets

Portlets are the visible components that act as the interface to applications and content. A portlet is referenced as a resource in AquaLogic Enterprise Security in the following manner:

>     //app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Portlet/portlet_login1

where `portlet_login` is the label definition of the portlet.

If you define an authorization policy at the `portlet_login1`level, you can control access at the `portlet_login1` Portlet level.

Table 5-9 shows an authorization policy that grants the `view` privilege to the `portlet_login1` Portlet for visitors in the SampleVisitor role.

Table 5-9 Portlet_login1 Authorization Policy

Effect | Privilege | Resource | Policy Subject
--- | --- | --- | ---
> Grant | view |
>     /myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Portlet/portlet_login1
| SampleVisitor role

#### Configuring Policy for Look and Feels

A Look and Feel is a selectable combination of skins and skeletons that determine the physical appearance of a portal desktop. A Look and Feel is referenced as a resource in AquaLogic Enterprise Security in the following manner:

>     //app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/LookAndFeel/textLookAndFeel

where `textLookAndFeel` is the label definition of the Look and Feel.

If you define an authorization policy at the `textLookAndFeel`level, you can control access at the `textLookAndFeel` level.

Table 5-10 shows an authorization policy that grants the `view` privilege to the `textLookAndFeel` Look and Feel visitors in the SampleVisitor role.

Table 5-10 Portlet_login1 Authorization Policy

Effect | Privilege | Resource | Policy Subject
--- | --- | --- | ---
> Grant | view |
>     /myrealm/portalapp/wlp/sampleportal/com_bea_p13n/LookAndFeel/textLookAndFeel
| SampleVisitor role

#### Defining Policy for Portlets using Instance ID

Portlets have a unique instance ID that allows for granular authorization policy definition outside the standard hierarchy of the Desktop->Book->Page->Portlet. To use this in AquaLogic Enterprise Security, add a condition statement in the portlet rule that adds the portlet instance ID. For example:

>     grant( [//priv/maximized,//priv/minimized,//priv/view], //app/policy/myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Portlet
>     /portlet_login1, //role/Operator) if instanceid = "portlet_login1";

Table 5-11 shows an authorization policy that grants the `view` privilege to the `portlet_login1` Portlet for visitors in the Operator role.

Table 5-11 Portlet_login1 Authorization Policy Using Instance ID

Effect | Privilege | Resource | Policy Subject | Condition
--- | --- | --- | --- | ---
> Grant | view |
>     /myrealm/portalapp/wlp/sampleportal/com_bea_p13n/Portlet/portlet_login1
> | Operator role |
>     if instanceid = "portlet_login1";

## Discovering Portal Application Resources

When developing policies for use with a Security Service Module, you can use the discovery mode feature of the AquaLogic Enterprise Security Administration Server to help define your policy components. Instructions for using discovery mode are provided in the Resource Discovery section in the Policy Managers Guide.

## Distributing Policy and Security Configuration

Distribute policy and security configuration to the WebLogic Server 8.1 Security Service Module.

For information on how to distribute policy and security configuration, see the Console Help. Be sure to verify the results of your distribution.

## Starting the WebLogic Portal Server

To start a WebLogic Portal server, perform the following steps:

1. Open a shell (command prompt) on the machine on which you created the portal domain.
2. Change to the portal domain directory: `BEA_HOME\user_projects\domains\portalDomain`.
3. Run the following script:

On Windows: `startWebLogic.cmd`

On UNIX: `startWeblogic.sh`

## Configuring Portal Administration to Use the WebLogic Authenticator

To use the WebLogic Authentication provider to manage administrative users for portal administration, perform the following steps:

1. Within the Portal Administration console, go to `Service Administration`.
2. Select `Authentication Hierarchy Service`.
3. Add `WebLogicAuthenticator` to the Authentication Providers to Build list.

## Using Portal Administration Tools to Create a Portal Desktop

Before you can use AquaLogic Enterprise Security to control access to a portal desktop, you must use WebLogic Portal Administration Tools to create a portal desktop.

To create a portal desktops, perform the following steps:

1. To have full control of the definition and instance labels, use WebLogic Workshop 8.1 to create the initial portal application.
2. Using the initial portal application as a template, use the Portal Administration Tools to create the portal desktops.

For instructions on using Portal Administration Tools to create portal desktops, see Create a Desktop in the WebLogic Administration Portal Online Help.

To create a portal desktop for the sample portal application using the Portal Administration Tools, perform the following steps:

1. Open a browser and point it to: `http://localhost:7001/testportalappAdmin`. The Sign In page appears.
2. Enter Username: `portaladmin`, Password: `portaladmin`, and click Sign In. The Portal Resources navigation tree appears.
3. Right click on Portals and select New Portal. The Portal Resource page appears.
4. Enter a Name for this Portal, for example: `myportal`, enter a partial URL for this Portal, for example: `myportal`, and click Save. The Available Portals list appears.
5. Select the `myportal` link from the list. The Editing Portal: `myportal` page appears.
6. Click Create New Desktop. The New Desktop Properties dialog appears.
7. Enter Title, for example: `mydesktop` and a Partial URL, for example: `mydesktop`.
8. Choose a Template:Choose: `testportalweb/test.portal` and click Create New Desktop. Desktops contained in Portal `myportal` list appear.
9. Select `mydesktop` from the list. The Editing Desktop: `mydesktop` page appears.
10. Select View Desktop. `mydesktop` is displayed in a new browser window. Verify that the desktop contains the sample portal application.
11. Close the mydesktop browser and Logout. The Sign In page appears.
12. Exit the Portal Administration Tool by closing its browser.

## Accessing the Portal Application

To access a portal application running on a portal server, open a browser and point it to the desktop URL. For example, if you set up the desktop for the sample portal application as described in Using Portal Administration Tools to Create a Portal Desktop, you can access the sample portal application using the following URL:

`http://<``host_name``>:7001/sampleportal/appmanager/myportal/mydesktop`

where <`host_name`> is the machine on which portal application is running.