Skip navigation.
Downloads | Product Documentation | Support

Administration Application Guide

# Introduction to System Administration

This section provides an introduction to system administration tasks and discusses the various tools available for configuring and managing your enterprise using WebLogic® Enterprise Security. If you are not familiar with the architecture and services provided, please see the Introduction to WebLogic Enterprise Security. This document provides a starting point for System Administrators who are using the WebLogic Enterprise Security Administration Application.

This section covers the following topics:

- About This Document
- Overview of System Administration
- Distributed Computing Security Infrastructure
- Administration Console

# About This Document

This document describes how to use the Administration Application to configure and deploy security service modules. It is organized as follows:

- Introduction to System Administration, provides an overview, conceptual, and architectural information for the WebLogic Enterprise Security products.
- Failover and System Reliability, describes WebLogic Enterprise Security features that support recovery from failure.
- Administration Policy, describes the default policy supplied with the product.
- Security Administration, describes basic concepts used in WebLogic Enterprise Security Console and how to design and implement your security policy.
- Using the Console, describes how to use the Administration Console to the Administration Console, how to log on and off, and how to configure failover.
- Starting and Stopping Services,describes the fundamentals of the BEA WebLogic Enterprise Security services and how to start and stop those services.
- Configuring Secure Sockets Layer for a Production Environment, describes how to configure SSL to use digital certificates suitable for a production environment rather than the demonstration certificates configured by default in the WebLogic Enterprise Security Administration Application.
- Enabling Single Sign On,describes the setup steps necessary to achieve Single Sign-On (SSO) integration with .NET based web services clients, as well as Internet Explorer browser clients.
- Security Configuration, describes how to use the providers to implement your security polices and how to configure custom providers using the Administration Console.
- Performance and Caching, discusses issues of performance when implementing authorization policies and how to configure your providers for the improved performance.
- Deployment, describes how to distribute configuration and policy data to Security Service Modules and Service Control Managers.
- Provider Extensions, describes advanced concepts of how to use plug-in function that you write to extend the capabilities of the existing providers.
- Audit Events, describes the audit events you can use through the Audit plug-in and Log4j Audit Channel provider.
- Function Reference, describes the C++ API that you can use to write an Authorization plug-in.

## Audience

This administration guide is written for Administrators who are implementing and maintaining security configurations, authentication and authorization schemes, and setting up and maintaining access to deployed application resources. Application Administrators have a general knowledge of security concepts and the Java security architecture. They understand Java, XML, deployment descriptors, and can identify security events in server and audit logs.

The Administrator configures all security providers, implementing authentication, authorization, role mapping, auditing and failover policies. The Administrator may or may not be responsible for installation and configuration of the database component, but must be familiar with the enrollment process.

## Product Documentation on the dev2dev Web Site

BEA product documentation, along with other information about BEA software, is available from the BEA dev2dev web site:

http://dev2dev.bea.com

To view the documentation for a particular product, select that product from the Product Centers menu on the left side of the screen on the dev2dev page. Select More Product Centers. From the BEA Products list, choose WebLogic Enterprise Security 4.2. The home page for this product is displayed. From the Resources menu, choose Documentation 4.2. The home page for the complete documentation set for the product and release you have selected is displayed.

## Related Information

The BEA corporate web site provides all documentation for BEA WebLogic Enterprise Security. Other BEA WebLogic Enterprise Security documents that may be of interest to the reader include:

- Introduction to WebLogic Enterprise Security—This document summarizes the features of the BEA WebLogic® Enterprise Security products and presents an overview of the architecture and capabilities of the security services. It provides a starting point for understanding the family of BEA WebLogic Enterprise Security products.
- Programming Security for Java Applications—This document describes how to implement security in Java applications. It includes descriptions of the Security Service Application Programming Interfaces and programming instructions.
- Developing Security Providers for BEA WebLogic Enterprise Security —This document provides security vendors and security and application developers with the information needed to develop custom security providers.
- BEA WebLogic Enterprise Security Policy Managers Guide—This document defines the policy model used by BEA WebLogic Enterprise Security, and describes how to import and export policy data.
- Javadocs for Java API—This document provides reference documentation for the Java Application Programming Interfaces that are provided with and supported by this release of BEA WebLogic Enterprise Security.
- Javadocs for Security Service Provider Interfaces—This document provides reference documentation for the Security Service Provider Interfaces that are provided with and supported by this release of BEA WebLogic Enterprise Security.

# Overview of System Administration

You manage a WebLogic Enterprise Security environment by using any of several system administration tools provided with the product. A WebLogic Enterprise Security environment can consist of a single Administration Application instance or multiple instances, each hosted on one or more physical machines; one or more Service Control Managers hosted on individual machines, with any number of Security Service Modules associated with each one. The system administration tools include the Administration Console, the Policy Import and Export tools, a Policy Distributor, Policy Database, and an API, with which you manage security, database connections, messaging, transaction processing, and the runtime configuration of your applications. You may also want to configure a meta-directory to manage users.

The basic administrative unit for a WebLogic Enterprise Security installation is called an enterprise domain. An enterprise domain is a logically related group of Security Service Modules from which the Administration Server manages resources as a unit. An enterprise domain always includes at least one Administration Server instance, one Service Control Manager, and one Security Service Module. The Administration Server serves as a central point of contact for instances and system administration tools.

Figure 1-1 Administration Server Architecture

You can configure multiple servers to be part of a cluster to support failover. A cluster is a group of server instances that work together to provide scalability and high-availability for applications. For additional information on configuring WebLogic Enterprise Security for failover, see Failover and System Reliability.

Your enterprise domain is divided into smaller domains, based on the number of Security Service Modules you have installed. Each Security Service Module may share or use different configuration or policy data, based on the business needs of an organization.

# Distributed Computing Security Infrastructure

Applications across the enterprise are built on a heterogeneous infrastructure with diverse resources. With an application security infrastructure as shown in Figure 1-2, the Security Service Modules support a fully distributed architecture; all applications across the network are integrated.

Figure 1-2 Distributed Computing Security Infrastructure

The BEA WebLogic Enterprise Security products provide a variety of services that use its Security Framework, including enhanced policy-based authorization with role mapping, authentication with support for single sign-on and credential mapping, and customizable auditing features. A services-oriented strategy to application security infrastructure improves efficiency and strengthens security by providing a unified and consistent approach across the enterprise. BEA delivers security services that allow third-party security technologies to be exposed as reusable services, to further reduce integration time and costs, promote choice, and ensure investment protection.

The type of security services you implement depends on the type of the application component itself, and enforcement solutions are implemented as a set of providers delivered with each Security Service Module. The BEA WebLogic Enterprise Security services seek to provide ease of use, manageability for end users and administrators, and customizability for application developers and security developers. Administrators who configure and deploy applications can use the providers included with the product that support most standard security functions.

- WebLogic Server 8.1 Security Service Module

Supports BEA WebLogic Server, Version 8.1 and enhances the existing security services in the application server, providing customizable auditing, multi-domain standards-based single sign-on, database and Microsoft Window NT authentication, database credential mapping, and expanded policy expression capabilities for authorization and role assignments.

- IIS Web Server Security Service Module

Supports the IIS Web Server. After installation, the security service module (SSM) binds with the web server through the web server application programming interface (ISAPI) so that the SSM can be used to protect web server application resources.

- Apache Web Server Security Service Module

Supports the Apache Web Server. After installation, the SSM binds the web server through the web server filter so that the SSM can be used to protect web server application resources.

- Web Services Security Service Module

Supports web servers. After installation, the SSM security services can be accessed by a web server through the Web Services application programming interface and used to protect web server application resources.

- Java Security Service Module

An application programming interface (API) that allows security developers to develop environment interfaces or even integrate an application security infrastructure into an application. These interfaces support the most commonly required security functions and are organized into services that are logically grouped by functionality.

Figure 1-3 Security Framework

Each Security Service Module is delivered with a full set of security providers. Table 1-1 lists the types of providers that are available for configuration. For information on configuring providers, see Security Configuration.

Table 1-1 Security Providers

Provider | Description
--- | ---
Authentication Provider | Supports open-standard support for SAML and X.509 identity assertion, and authentication support for Microsoft Windows NT, Microsoft Active Directory, Netscape LDAP, Novell LDAP, relational database, and OpenLDAP login modules. Identity Assertion Provider—enables perimeter-based authentication to support single sign-on, and allows users or system processes to assert their identity using certificate-based authentication, SAML, or other token formats. Principal Validation Provider—enhances security by signing and verifying the authenticity of the principals.
Credential Mapping Provider | Maps credentials used by a legacy or any remote system. The application then uses the appropriate credentials to log in to a remote system on behalf of a subject that already authenticated to support single sign-on.
Authorization Provider | Controls access to resources based on the role and policy assigned to the requested resource. An access decision is the part of the authorization provider that actually determines whether a user has permission to perform an operation on a resource. Secures access to resources and transactions, enabling an organization with increasingly complex user communities to provide secure finely-grained access to resources. Access decisions provided through a role-based authorization provider incorporate relevant environmental, contextual, and transaction-specific information, allowing security policies to support business processes throughout the organization. Adjudication Provider—resolves authorization conflicts when you configure multiple authorization providers.
Role Mapping Provider | Supports dynamic role associations by obtaining a computed set of roles granted to a requestor for a resource.
Auditing Provider | Provides an electronic trail of all transaction activity and can include changes to system configuration parameters, policy changes, and transactions. For each audit item, the information can include who, what, when, where, and sometimes why.

## Attributes

System administration infrastructure in WebLogic Enterprise Security is implemented using attributes that can be configured through the Administration Console; thus, it is necessary that you understand how they are used.

Providers contain a set of attributes that define configuration parameters for various Security Service Modules. Many attributes for administration have pre-set or default values. When the Administration Server starts, it reads the configuration from the database and overrides the default attribute values of the attributes with any values found. Every time you change an attribute using the Administration Console or administration tools, its value is stored in the database. Each instance of a Security Service Module has its own configuration, although it may share its configuration with other like modules.

Attributes may be associated with users or groups (subject attributes), resources (resource attributes) or policy requests (dynamic attributes). Characteristics that define users, groups directories are called identity attributes. Attributes may be descriptive, configure policy behavior, manage delegated administration, or be used in forming policy as part of the policy condition. Attributes must have a defined type, which denotes the range of legal values that an attribute may have. A number of predefined types exist, such as string, date, time, ip address, or you can supply custom attribute types. The value of the attribute may be assigned to only one instance of an attribute. For a more complete description of how to use attributes in rules, see "Securing Resources and Defining Policy Rules," in the BEA WebLogic Enterprise Security Policy Managers Guide.

## Security Protections for System Administration Tools

All system administration operations are protected based on the user name employed to access a system administration tool. A user (or the group a user belongs to) must be a member of one of four security roles. These roles grant or deny a user access to various sets of system administration operations. The roles are Admin, Operator, Deployer, and Monitor. For additional information on Administration roles, see Administration Policy.

# Administration Console

The Administration Console is a web application hosted by the Administration Server. You access the Administration Console from any machine on the local network that can communicate with the Administration Server through a web browser (including a browser running on the same machine as the Administration Server). The Administration Console allows you to manage your enterprise domain containing multiple instances of Security Service Modules. For information on general use of the Administration Console, see Using the Console.

Through the Administration Application, system administrators can perform all management tasks without having to learn about the underlying management architecture. These management capabilities include:

- Security Configuration
- Failover and System Reliability
- Securing Resources and Defining Policy Rules
- Configuring a Metadirectory
- Deployment
- Import policy data
- Export Policy data
- Starting and Stopping Security Service Module Processes
- Configuring Secure Sockets Layer for a Production Environment
- To learn more about any of these topics, simply click the associated link. For information on starting the Administration Console, see Using the Administration Console. Online help is available from the Administration Console by clicking on the "?" icon located in the upper right portion of the console.