bea.com | products | dev2dev | support | askBEA

Download Docs | Site Map | Glossary
Search

Administration Console Online Help

Default Role Mapping --> General

Tasks Additional Documentation Attributes

Overview

Use this tab to configure a Role Mapping provider for a security realm. Role Mapping providers support security policies (dynamic role associations) by obtaining a computed set of roles granted to a requestor for a given resource. Role Mapping providers supply Authorization providers with this role information so that the Authorization Provider can answer the "is access allowed?" question for resources that use role-based security (that is, Web application and Enterprise JavaBean container resources).

The WebLogic Security Framework will use business logic and the current operation parameters (obtained from the J2EE and WebLogic deployment descriptor files) to determine which roles (if any) apply to the particular Subject at the moment in which access is required for a given resource. If multiple Role Mapping providers are configured, the set of roles returned by all Role Mapping providers will be intersected by the WebLogic Security Framework.

By default, the WebLogic Role Mapping provider is configured in myrealm. You can use a Custom Role Mapping provider instead of the WebLogic Role Mapping provider. For a Custom Role Mapping provider to appear on the Role Mapper tab, the MBean JAR file for the provider must be in the WL_HOME\lib\mbeantypes directory.

A Role Mapping provider that supports deploying roles on behalf of Web application or Enterprise JavaBean (EJB) deployments needs to implement the DeployableRoleProvider Security Service Provider Interface (SSPI) instead of the RoleProvider SSPI. You also need to enable the Role Deployment Enabled attribute on this tab. The Role Deployment Enabled attribute is enabled by default for the WebLogic Role Mapping provider.

During application deployment, WebLogic Server reads role mappings from the weblogic.xml and weblogic-ejb-jar.xml files. This information is used to populate the WebLogic Role Mapping provider. Any changes made to the role mappings through the WebLogic Server Administration Console are not persisted to the weblogic.xml and weblogic-ejb-jar.xml files. Before you deploy the application again (which will happen if you redeploy it through the WebLogic Server Administration Console, modify it on disk, or restart WebLogic Server), you need enable the Ignore Security Data in Deployment Descriptors attribute on the General tab for the security realm.

Tasks

Configuring a Role Mapping Provider

Additional Documentation

(Requires an Internet connection.)

Introduction to WebLogic Security

Managing WebLogic Security

Programmimg WebLogic Security

Developing Security Providers for WebLogic Server

Securing a WebLogic Server Deployment

Upgrading Security in WebLogic Server Version 6.x to WebLogic Server Version 7.0

Security FAQ

The Security page in the WebLogic Server documentation

Attributes

Attribute Label | Description | Value Constraints
--- | --- | ---
Name | The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration. Attribute: Name | Configurable: yes Readable: yes Writable: yes
Description | A short description of the WebLogic Role Mapping provider. Attribute: Description | Default: "Weblogic Default Role Mapper Provider" Readable: yes
Version | The version number of the WebLogic Role Mapping provider. Attribute: Version | Default: "1.0" Readable: yes
Role Deployment Enabled | Indicates whether this Role Mapping provider stores roles that are created while deploying a Web application or EJB. Attribute: RoleDeploymentEnabled | Default: true Readable: yes