bea.com | products | dev2dev | support | askBEA

Download Docs | Site Map | Glossary
Search

Administration Console Online Help

Compatibility Security

This topic describes configuring and managing security when using Compatibility security. For more information, see Using Compatibility Security in Managing WebLogic Security. For information about using the security features in WebLogic Server 7.0, see Security in the Administration Console online help and Managing WebLogic Security.

Tasks

Using Compatibility Security

Compatibility security refers to the capability of running security configurations from WebLogic Server 6.x in WebLogic Server 7.0. In the Compatibility security, you configure security realms, define users, groups, and ACLs as you did in WebLogic Server 6.x.

To use Compatibility security:

1. A sample config.xml file that can be used to boot Compatibility security can be found in Booting WebLogic Server in Compatibility Security in the Upgrade Guide for BEA WebLogic Server 7.0.

2. Add the following to the 6.x config.xml file:

   <Security Name="mydomain" Realm="mysecurity"/>
   <Realm Name="mysecurity" FileRealm="myrealm"/>
   <FileRealm Name="myrealm"/>

3. Install WebLogic Server 7.0 in a new directory location. Do not overwrite your existing 6.x installation directory. For more information, see the WebLogic Server Installation Guide.

4. Modify the startup script for your 6.x server to point to the WebLogic Server 7.0 installation. Specifically, you need to modify:

   - The classpath to point to the weblogic.jar file in the WebLogic Server version 7.0 installation.

   - The JAVA_HOME variable to point to the WebLogic Server version 7.0 installation.

   For more information, see theUpgrade Guide for BEA WebLogic Server 7.0.

5. Use the startup script for your 6.x server to boot WebLogic Server.

To verify if you are correctly running Compatibility security, do the following:

1. In the WebLogic Server Administration Console (referred to as the Administration Console), expand the Domain node.

2. Click on your WebLogic Server domain (referred to as the domain).

3. Click the View the Domain Log link.

   The following message appears in the log:

   Security initializing using realm CompatibilityRealm

In addition, a CompatibilitySecurity node will appear in the WebLogic Server Administration Console.

Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider

The Realm Adapter Authentication provider includes an Identity Assertion provider.The Identity Assertion provider provides backward compatibility for implementations of the weblogic.security.acl.CertAuthenticator class. The identity assertion is performed on X.509 tokens. By default, the Identity Assertion provider is not enabled in the Realm Adapter Authentication provider.

To enable identity assertion in the Realm Adapter Authentication provider:

1. Expand the Security-->Realms nodes.

2. Click the CompatibilityRealm.

3. Expand the Providers node.

4. Click Authentication Providers.

5. Click the Realm Adapter Authenticator link in the Realms table.

   The General tab appears.

6. Enter X.509 in the Active Types list box.

   This step enables the use of 6.x Cert Authenticators.

7. Click Apply.

8. Reboot WebLogic Server.

Configuring a Realm Adapter Auditing Provider

The Realm Adapter Auditing provider allows you to use implementations of the weblogic.security.audit.AuditProvider class when using Compatibility security. In order for the Realm Adapter Auditing provider to work properly, the implementation of the weblogic.security.audit.AuditProvider class must have been defined in the Audit Provider class attribute on the Domain-->Security-->General tab.

To configure a Realm Adapter Auditing provider:

1. Expand the Compatibility Security-->Realms nodes.

2. Expand the Providers node.

3. Click Auditors.

4. Click Configure a Realm Adapter Auditor... link.

   The General tab appears

5. Click Create to save your changes.

6. Reboot WebLogic Server.

Changing the System Password

To change the system password:

1. Expand the Compatibility Security node.

2. Click the Users tab.

   The User Configuration window appears.

3. Under Change a User's Password, enter system in the Name attribute.

4. Enter password you specified when installing WebLogic Server in the Old Password attribute.

5. Enter a new password in the New Password attribute.

6. Enter the new password again in the Confirm the Password attribute.

When you use an Administration Server and Managed Servers in a domain, the Managed Server must always use the password for the Administration Server in the domain. Always change the password for the Administration Server through the WebLogic Server Administration Console. When WebLogic Server is rebooted, the new password is propagated to all the Managed Servers in the domain.

Configuring the File Realm in the CompatibilityRealm

To configure the File realm:

1. Expand the Domains node.

2. Click the Security tab.

3. Click the Security-->File Realm tab.

4. Enter values in the attribute fields on the Domain --> Security --> File Realm tab.

5. Click Apply.

If, instead of the File realm, you want to use one of the alternate security realms provided by WebLogic Server or a custom security realm, set the attributes for the desired realm and reboot WebLogic Server. If you use one of the alternate security realms, you must configure the Caching realm.

All user and group data for the File realm is stored in the fileRealm.properties file. If the fileRealm.properties file becomes corrupted or is destroyed, you must reconfigure the security information for WebLogic Server. Compatibility security cannot run without a fileRealm.properties file. Even if you write a custom security realm, you still need a fileRealm.properties file to boot WebLogic Server. Therefore, BEA recommends that you take the following steps:

1. Make a backup copy of the fileRealm.properties file and put it in a secure place.

2. Set the permissions on the fileRealm.properties file such that the administrator of the WebLogic Server deployment has write and read privileges and no other users have any privileges.

Note: Also make a backup copy of the SerializedSystemIni.dat file for the File realm.

Configuring the Caching Realm in the CompatibilityRealm

The Caching realm works with alternate security realms, or custom security realms to fulfill client requests with the proper authentication and authorization. The Caching realm stores the results of both successful and unsuccessful realm lookups. It manages separate caches for users, groups, permissions, ACLs, and authentication requests. The Caching realm improves the performance of WebLogic Server by caching lookups, thereby reducing the number of calls into other security realms.

If you are using an alternate security realm or a custom security realm, you must configure and enable the Caching realm after you configure an alternate or custom security realm.

When you enable caching, the Caching realm saves the results of a realm lookup in its cache. Lookup results remain in the cache until either the specified number of seconds defined for the time-to-live (TTL) attributes has passed (the lookup result has expired) or the cache has filled. When the cache is full, new lookup results replace the oldest cached results. The TTL attributes determine how long a cached object is valid. The higher you set these attributes, the less often the Caching realm calls the secondary security realm. Reducing the frequency of such calls improves the performance. The trade-off is that changes to the underlying security realm are not recognized until the cached object expires.

By default, the Caching realm operates on the assumption that the alternate security realm is case-sensitive. In a case-sensitive security realm, the owners of usernames bill and Bill, for example are treated as two distinct users. The Windows NT Security realm and the LDAP Security realm are examples of security realms that are not case-sensitive. If you are using a security realm that is not case-sensitive, you must disable the Cache Case Sensitive attribute. When this attribute is set, the Caching realm converts usernames to lowercase so that WebLogic Server gives correct results for the security realm when it performs case-sensitive comparisons. When defining or referencing users or groups in a case-sensitive security realm, type usernames in lowercase.

To configure the Caching realm:

1. Configure the alternate or custom security realm with which you will use the Caching realm.

2. Expand the Caching Realms node.

3. Click the Configure a new Caching Realm... link.

4. Enter values in the attribute fields on the Caching Realm --> General tab.

5. Click Create.

6. Enable the caches you want to use with the Caching realm. For more information, see:

   - Enabling the ACL Cache

   - Enabling the Authentication Cache

   - Enabling the Group Cache

   - Enabling the User Cache

   - Enabling the Permission Cache

7. When you finish defining attributes for the Caching realm, reboot WebLogic Server.

Enabling the ACL Cache

1. Click the ACL tab under the Caching Realm tab.

2. Configure and enable the ACL cache by defining values for the attributes shown on the Caching Realm --> ACL tab.

3. Click Apply to save your changes.

Enabling the Authentication Cache

1. Click the Authentication tab under the Caching Realm tab.

2. Configure and enable the Authentication cache by defining values for the attributes shown on theCaching Realm --> Authentication tab.

3. Click Apply to save your changes.

Enabling the Group Cache

1. Click the Group tab under the Caching Realm tab.

2. Configure and enable the Group cache by defining values for the attributes shown on theCaching Realm --> Groups tab.

3. Click Apply to save your changes.

Enabling the User Cache

1. Click on the User tab under the Caching Realm tab.

2. Configure and enable the User cache by defining values for the attributes shown on theCaching Realm --> Users tab.

3. Click Apply to save your changes.

Enabling the Permission Cache

1. Click on the Permission tab under the Caching Realm tab.

2. Configure and enable the Permission cache by defining values for the attributes shown on theCaching Realm --> Permissions tab.

3. Click Apply to save your changes.

Adding a Note to the Caching Realm

1. Click on the Notes tab under the Caching Realm tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Configuring an LDAP Realm V1 in the CompatibilityRealm

The LDAP security realm provides authentication through a Lightweight Directory Access Protocol (LDAP) server. This server allows you to manage all the users for your organization in one place: the LDAP directory. The LDAP security realm supports Open LDAP, Netscape iPlanet, Microsoft Site Server, and Novell NDS directory servers.

To configure an LDAP V1 security realm:

1. Expand the Compatibility Security node.

2. Expand the Realms node.

3. Click the Configure a New LDAP Realm V1... link.

   The name of the class that implements the LDAP Security realm is displayed.

4. Click Create.

5. Define attributes for the LDAP directory server and specify how users and groups are stored in the LDAP V1 security realm. For more information:

   - Defining Attributes for the LDAP Directory Server

   - Specifying How Users Are Stored in the LDAP V1 Security Realm

   - Specifying How Groups Are Stored in the LDAP V1 Security Realm

6. Configure the Caching realm. For more information, see Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select the LDAP Realm V1 from the pull-down menu for the Basic attribute on the General tab. The Basic attribute defines the association between the Caching realm and the alternate security realm (in this case, the LDAP Realm V1).

7. Expand the Domains node.

8. Click the Security tab.

9. Click the File Realm tab.

10. In the Caching Realm attribute, choose the name of the Caching realm to be used with the LDAP V1 security realm. A list of configured Caching realms appears on the pull-down menu.

11. Reboot WebLogic Server.

Defining Attributes for the LDAP Directory Server

1. Click the LDAP Realm V1 tab.

2. To enable communication between the LDAP server and WebLogic Server define values for the attributes on the LDAP V1 Security Realm --> LDAP Server tab.

3. Click Apply to save your changes.

Specifying How Users Are Stored in the LDAP V1 Security Realm

1. Click the Users tab under the LDAP Realm V1 tab.

2. To specify how users are stored in the LDAP V1 security realm define the attributes shown on the LDAP V1 Security Realm --> Users tab.

3. Click Apply to save your changes.

Specifying How Groups Are Stored in the LDAP V1 Security Realm

1. Click on the Groups tab under the LDAP Realm V1 tab.

2. To specify how Groups are stored in the LDAP directory, define the attributes shown on theLDAP V1 Security Realm V1 --> Groups tab.

3. Click Apply to save your changes.

Adding a Note to the LDAP V1 Security Realm

1. Click on the Notes tab under the LDAP Realm V1 tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Configuring an LDAP V2 Realm in the CompatibilityRealm

Configuring the LDAP realm V2 involves defining attributes that enable the security realm to communicate with the LDAP server and attributes that describe how users and groups are stored in the LDAP directory. In Compatibility security, the LDAP realm V2 is configured as a custom security realm.

The LDAP tree and schema is different for every LDAP server. The Supported Server Templates has templates for the supported LDAP servers. These templates specify default configuration information used to represent users and groups in each of the supported LDAP servers.

To use a LDAP realm V2:

1. Expand the Compatibility Security-->Realms nodes.

2. Click the Configure a new Custom Realm... link.

3. Set attributes on the Configuration tab.

   The following table describes the attributes you set on the Custom Security Realm Configuration window.

   Table 21-1 Custom Security Realm Attributes

   Attribute | Description
   --- | ---
   Name | Name of the LDAP realm V2, such as defaultLDAPRealmForNetscapeDirectoryServer.
   Realm Class Name | Name of the WebLogic class that implements the LDAP V2 realm such as weblogic.security.ldaprealmv2. LDAPRealm. This class needs to be in the CLASSPATH of WebLogic Server.
   Configuration Data | Specify information specific to your LDAP configuration for the following: server.host—The host name of the LDAP server. server.port—The port number on which the LDAP server listens. useSSL—Specifies whether or not to use SSL to protect communications between the LDAP server and WebLogic Server. Set the value to true to enable the use of SSL. server.principal—The LDAP user used by WebLogic Server to connect to the LDAP server. server.credential—The password of the LDAP user user by WebLogic Server to connect to the LDAP server. user.dn—The base DN of the tree in the LDAP directory that contains users. user.filter—The LDAP search filter for finding a user given the name of the user. group.dn—The base DN of the tree in the LDAP directory that contains groups. group.filter—The LDAP search filter for finding a group given the name of the group. membership.filter—The LDAP search filter for finding the members of a group given the name of the group. See Supported Server Templates for sample values for the supported LDAP servers.

4. Click Apply to save your changes.

5. Configure the Caching realm as described in Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select the LDAP realm V2 from the pull-down menu for the Basic Realm attribute on the General tab. The Basic Realm attribute defines the association between the Caching realm and the alternate security realm (in this case, the LDAP realm V2).

6. Expand the Domains node.

7. Select the Security-->File Realm tab.

8. In the Caching Realm attribute, choose the name of the Caching realm to be used with the LDAP realm V2. A list of configured Caching realms appears on the pull-down menu.

9. Reboot WebLogic Server.

Supported Server Templates

Listing 21-1 through Listing 21-4 are templates used to configure LDAP servers supported in the LDAP realm V2. Copy these templates directly into the config.xml file for your application.

Warning: Each line in the following code examples must appear on a single line. The examples in the code examples have been formated to fit the margins of this document and some lines have been broken to facilitate that formatting. If you paste this text into the config.xml file, be sure to concatentate the lines that are broken so that they appear on a single line in your code.

Listing 21-1 Default Netscape Directory Server Template

>     <CustomRealmName="defaultLDAPRealmForNetscapeDirectoryServer"
>     RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
>     ConfigurationData=
>     "server.host=ldapserver.example.com;
>     server.port=700;
>     useSSL=true;
>     server.principal=uid=admin,
>     ou=Administrators,ou=TopologyManagement,o=NetscapeRoot;
>     server.credential=*secret*;
>     user.dn=ou=people,o=beasys.com;
>     user.filter=(&amp;(uid=%u)(objectclass=person));
>     group.dn=ou=groups,o=beasys.com;
>     group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));
>     membership.filter=(&amp;(uniquemember=%M)
>        (objectclass=groupofuniquenames));

>     "Notes="Before enabling the LDAP V2 security realm, edit the configuration parameters for your environment."/>

Listing 21-2 Default Microsoft Site Server Template

>     <CustomRealmName="defaultLDAPRealmForMicrosoftSiteServer"
>     RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
>     ConfigurationData=
>     "server.host=ldapserver.example.com;
>     server.port=700;
>     useSSL=true;
>     server.principal=cn=Administrator,ou=Members,
>        o=ExampleMembershipDir;
>     server.credential=*secret*
>     user.dn=ou=Members, o=ExampleMembershipDir;
>     user.filter=(&amp;(cn=%u)(objectclass=member)
>        (!userAccountControl:1.2.840.113556.1.4.803:=2)));
>     group.dn=ou=Groups, o=ExampleMembershipDir;
>     group.filter=(&amp;(cn=%g)(objectclass=mgroup));
>     membership.scope.depth=1;microsoft.membership.scope=sub;
>     membership.filter=(|(&amp;(memberobject=%M)
>     (objectclass=memberof))(&amp;(groupobject=%M)
>     (objectclass=groupmemberof)));
>     membership.search=true;

>     "Notes="Before enabling the LDAP V2 security realm, edit the configuration parameters for your environment."/>

Listing 21-3 Default Novell Directory Services Template

>     <CustomRealmName="defaultLDAPRealmForNovellDirectoryServices"
>     RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
>     ConfigurationData=
>     "server.host=ldapserver.example.com;
>     server.port=700;
>     useSSL=true;
>     server.principal=cn=Admin, DC=BEASYS
>     server.credential= *secret*;
>     user.dn=ou=people,o=example.com;
>     user.filter=(&amp;(cn=%u)(objectclass=person));
>     group.dn=ou=groups,o=example.com;
>     group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));
>     membership.filter=(&amp;(member=%M)
>        (objectclass=groupofuniquenames));"

>     "Notes="Before enabling the LDAP V2 security realm, edit the configuration parameters for your environment."/>

Listing 21-4 Default Open LDAP Directory Services Template

>     <CustomRealmName="defaultLDAPRealmForOpenLDAPDirectoryServices"
>     RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
>     ConfigurationData=
>     "server.host=ldapserver.example.com;
>     server.port=700;
>     useSSL=true;
>     server.principal=cn=Manager, dc=example, dc=com;
>     server.credential= *secret*;
>     user.dn=ou=people, dc=example,dc=com;
>     user.filter=(&amp;(uid=%u)(objectclass=person));
>     group.dn=ou=groups,dc=example,c=com;
>     group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));
>     membership.filter=(&amp;(uniquemember=%M)     (objectclass=groupofuniquenames));"

>     "Notes="Before enabling the LDAP V2 security realm, edit the configuration parameters for your environment."/>

Adding a Note to the LDAP V2 Security Realm

1. Click on the Notes tab under the configuration window for the chosen LDAP server.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Configuring the Windows NT Security Realm in the CompatibilityRealm

The Windows NT Security realm uses account information defined for a Windows NT domain to authenticate users and groups. You can view users and groups in the Windows NT Security realm through the Administration Console, but you must manage users and groups through the facilities provided by Windows NT.

The Windows NT Security realm provides authentication (users and groups) but not authorization (ACLs). To update the ACL information in the filerealm.properties file that WebLogic Server uses, click Refresh on the General tab in the Security node after you change an ACL. If you use groups with your ACLs, reduce the frequency with which you must refresh the information in WebLogic Server. Changing the members of a Windows NT group allows you to manage individual users' access to WebLogic Server resources dynamically.

It is possible to use the Windows NT Security realm to authenticate against a Windows 2000 Active Directory primary domain controller. However, the authentication must be from a machine which is a member of the domain, not from the domain controller itself. There is no way to authenticate to the local user and group store if the machine running the Windows NT Security realm is a member of another domain.

The Windows NT Security realm can be run on the primary domain controller, on a machine that is a member of a Windows NT domain, or on a machine that is a member of the Windows NT domain and wants to use a mutually trusted domain.

To use the Windows NT Security realm:

1. Expand the Compatibility Security node.

2. Expand the Realms node.

3. Click the Configure a New NT Realm... link.

4. Set attributes on the Windows NT Realm --> Configuration tab that define a name for the Windows NT realm and the computer on which the Windows NT domain is running.

5. Click Create.

6. Configure the Caching realm. For more information, see Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select your Windows NT security realm from the pull-down menu for the Basic attribute on the General tab. The Basic attribute defines the association between the Caching realm and the alternate security realm (in this case, the Windows NT security realm).

7. Expand the Domains node.

8. Click the Security tab.

9. Click the File Realm tab.

10. In the Caching Realm attribute, choose the name of the Caching realm to be used with the Windows NT security realm. A list of configured Caching realms appears on the pull-down menu.

11. Reboot WebLogic Server.

Use the following command to verify that you have the correct privileges to run WebLogic Server as the specified Windows NT user:

java weblogic.security.ntrealm.NTRealm username password

where username and password are the username and password of the Windows NT account under which WebLogic Server runs.

The output from this command indicates if the specified username and password authenticated properly.

Table 21-2 Windows NT Authentication Verification

Command Output | Meaning
--- | ---
auth?poppy | The entered username and password authenticated correctly.
auth?null | The entered username and password did not authenticate properly.

If the test comes up with an immediate failure stating that the client or user running WebLogic Server does not have the privileges to run the Windows NT Security realm,then it may be necessary to do one of two things:

- Boot the server using -Dweblogic.security.ntrealm.logonNetwork=true to change the NTRealm's NT Logon from LOGON32_LOGIN_INTERACTIVE to LOGON32_LOGIN_NETWORK.

- Update the permissions (referred to as rights) for the Windows user running WebLogic Server to provide the user with the NT "Log on Locally" user right. For more information, see Updating Users Permissions for Windows NT and Windows 2000.

Updating Users Permissions for Windows NT and Windows 2000

To update the rights in Windows NT:

1. On the Start menu, select Programs—>Administrative Tools.

2. Select User Manager.

3. Under the Policies menu, choose the User Rights option.

4. Check the Show Advanced Users Rights option.

5. Give the following rights to the Windows user running WebLogic Server:

   - Act as part of the operating system

   - Create a token object

   - Replace a process level token

6. Verify that the Windows user running WebLogic Server is a member of the Administrators group.

7. Reboot Windows NT to ensure all the modifications take effect.

8. Verify that the Logon as System Account option is checked. Note that the Allow System to Interact with Desktop option does not need to be checked. Running the Windows NT Security realm under a specific Windows NT user account does not work.

To update the rights in Windows 2000:

1. On the Start menu, select Programs—>Administrative Tools.

2. Select Local Security Policy.

3. Go to Local Policies—>User Rights Assignment.

4. Give the following rights to the Windows user running WebLogic Server:

   - Act as part of the operating system

   - Create a token object

   - Replace a process level token

5. Verify that the Windows user running WebLogic Server is a member of the Administrators group.

6. Reboot Windows 2000 to ensure all the modifications take effect.

7. Verify that the Logon as System Account option is checked. Note that the Allow System to Interact with Desktop option does not need to be checked. Running the Windows NT Security realm under a specific Windows NT user account does not work.

The following are common Windows NT error codes that occur when using the Windows NT Security realm:

Table 21-3 Windows NT Error Codes

Error Code | Meaning
--- | ---
1326 | The host machine running the security realm does not have a trust relationship with the primary domain controller. The host machine may not be a member of the domain or the domain may not trust the host machine.
53 | A network error has indicates that the path to the primary domain controller could not be located. This error can occur if the domain name is misspelled or if the domain name is specified rather than the host name of the primary domain controller.

A full explanation of the Windows NT error codes is found in the winerror.h file.

Adding a Note to the Windows Security Realm

1. Click on the Windows NT Realm --> Notes tab under the Configuration tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Configuring the UNIX Security Realm in the CompatibilityRealm

Note: The UNIX Security realm runs only on the Solaris and Linux platforms.

The UNIX Security realm executes a small native program, wlauth, to look up users and groups and to authenticate users on the basis of their UNIX login names and passwords. The wlauth program uses Pluggable Authentication Modules (PAM), which allow you to configure authentication services in the operating system without altering applications that use the service.

After you change an ACL, click Refresh on the General tab in the Security to update the information in the filerealm.properties file that WebLogic Server uses. If you use groups with your ACLs, reduce the frequency with which you must refresh the information in WebLogic Server. Changing the members of a UNIX group allows you to manage individual users' access to WebLogic Server resources dynamically.

The wlauth program runs setuid root. You need root permissions to modify the ownership and file attributes on the wlauth program and to set up the PAM configuration file for wlauth.

To set up the wlauth program for the UNIX Security realm:

1. If WebLogic Server is installed on a network drive, copy the wlauth file to a file system on the computer that executes WebLogic Server, for example, the /usr/sbin directory. The wlauth file is in the weblogic/lib/arch directory, where arch is the name of your platform.

2. As the root user, run the following commands to change the wlauth owner and permissions:

   >       # chown root wlauth
   >       # chmod +xs wlauth

3. Set up the PAM configuration for wlauth.

   Solaris—Add the following lines to your /etc/pam.conf file:

   >       # Setup for WebLogic authentication on Solaris machines
   >       #
   >       wlauth auth required      /usr/lib/security/pam_unix.so.1
   >       wlauth password required  /usr/lib/security/pam_unix.so.1
   >       wlauth account required   /usr/lib/security/pam_unix.so.1

   Linux—Create a file called /etc/pam.d/wlauth containing the following:

   >       #%PAM-1.0
   >       #
   >       # File name:
   >       # /etc/pam.d/wlauth
   >       #
   >       # If you do not use shadow passwords, delete "shadow".
   >       auth required     /lib/security/pam_pwdb.so shadow
   >       account required  /lib/security/pam_pwdb.so

   Note: Omit shadow if you are not using shadow passwords.

To configure the UNIX security realm:

1. Expand the Compatibility Security node.

2. Expand the Realms node.

3. Click the Configure a New Unix Realm... link.

4. Set attributes on the Unix Realm --> Configuration tab that define a name for the realm and the program that provides authentication services for the UNIX Security realm.

5. Click Create.

6. Configure the Caching realm. For more information, see Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select your UNIX security realm from the pull-down menu for the Basic attribute on the General tab. The Basic attribute defines the association between the Caching realm and the alternate security realm (in this case, the UNIX security realm).

7. Expand the Domains node.

8. Click the Security tab.

9. Click the File Realm tab.

10. In the Caching Realm attribute, choose the name of the Caching realm to be used with the UNIX security realm. A list of configured Caching realms appears on the pull-down menu.

11. Reboot WebLogic Server.

Adding a Note to the UNIX Security Realm

1. Click on the Unix Realm --> Notes tab under the Configuration tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Configuring the RDBMS Security Realm in the CompatibilityRealm

Note: If your implementation of the RDBMS security realm uses the getActiveDomain() method, you need to edit and recompile your RDBMSDelegate class in order to use the RDBMS security realm with Compatibility security. Replace the getActiveDomain() method with the getSecurityConfig() method in the weblogic.server package.

The RDBMS Security realm is a BEA-provided custom security realm that stores users, groups and ACLs in a relational database. SQL scripts that populate a database are used to create groups for the RDBMS Security realm.

To configure the RDBMS Security realm:

1. Expand the Compatibility Security-->Realms nodes.

2. Set attributes on the General tab that define a name for the realm and the class that implements the RDBMS security realm.

3. Click Apply to save your changes.

4. Select the Database tab. Define attributes for the JDBC driver being used to connect to the database.

5. Click Apply to save your changes.

6. Select the Schema tab. Define the schema used to store Users, Groups, and ACLs in the database in the Schema Properties box on the Schema tab.

   Listing 21-5 contains the database statements entered in the Schema properties for the RDBMS security realm shipped with WebLogic Server.

Listing 21-5 Sample Schema for RDBMS Security Realm

>     "getGroupNewStatement=true;getUser=SELECT U_NAME, U_PASSWORD FROM users WHERE U_NAME = ?;
>     getGroupMembers=SELECT GM_GROUP, GM_MEMBER from groupmembers WHERE GM_GROUP = ?;
>     getAclEntries=SELECT A_NAME, A_PRINCIPAL, A_PERMISSION FROM aclentries WHERE A_NAME = ? ORDER BY A_PRINCIPAL;
>     getUsers=SELECT U_NAME, U_PASSWORD FROM users;
>     getGroups=SELECT GM_GROUP, GM_MEMBER FROM groupmembers;
>     getAcls=SELECT A_NAME, A_PRINCIPAL, A_PERMISSION FROM aclentries ORDER BY A_NAME, A_PRINCIPAL;
>     getPermissions=SELECT DISTINCT A_PERMISSION FROM aclentries;
>     getPermission=SELECT DISTINCT A_PERMISSION FROM aclentries WHERE A_PERMISSION = ?;
>     newUser=INSERT INTO users VALUES ( ? , ? );
>     addGroupMember=INSERT INTO groupmembers VALUES ( ? , ? );
>     removeGroupMember=DELETE FROM groupmembers WHERE GM_GROUP = ? AND GM_MEMBER = ?;
>     deleteUser1=DELETE FROM users WHERE U_NAME = ?;
>     deleteUser2=DELETE FROM groupmembers WHERE GM_MEMBER = ?;
>     deleteUser3=DELETE FROM aclentries WHERE A_PRINCIPAL = ?;
>     deleteGroup1=DELETE FROM groupmembers WHERE GM_GROUP = ?;
>     deleteGroup2=DELETE FROM aclentries WHERE A_PRINCIPAL = ?"

1. Click Apply to save your changes.

2. Configure the Caching realm. For more information, see Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select the RDBMS security realm from the pull-down menu for the Basic attribute on the General tab. The Basic attribute defines the association between the Caching realm and the alternate security realm (in this case, the RDBMS security realm).

3. Expand the Domains node.

4. Click the Security tab.

5. Click the File Realm tab.

6. In the Caching Realm attribute, choose the name of the Caching realm to be used with the RDBMS security realm. A list of configured Caching realms appears on the pull-down menu.

7. Reboot WebLogic Server.

Adding A Note to the RDBMS Security Realm

1. Click on the RDBMS Realm --> Notes tab under the Configuration tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Installing a Custom Security Realm in the CompatibilityRealm

You can create a custom security realm that draws from an existing store of users such as directory server on the network. To use a custom security realm, you create an implementation of the weblogic.security.acl.AbstractListableRealm interface or the weblogic.security.acl.AbstractManageableRealm interface and then use the Administration Console to install your implementation.

1. Expand the Compatibility Security node.

2. Expand the Realms node.

3. Click the Configure a New Custom Realm... link.

4. Set attributes on the Custom Realm --> Configuration tab that define a name for the custom security realm, specify the interface that implements the realm, and define how the users, groups, and optionally ACLs are stored in the custom security realm on the tab.

5. Click Create.

6. Configure the Caching realm. For more information, see Configuring the Caching Realm in the CompatibilityRealm

   When configuring the Caching realm, select the custom security realm from the pull-down menu for the Basic attribute on the General tab. The Basic attribute defines the association between the Caching realm and the custom security realm.

7. Expand the Domains node.

8. Click the Security tab.

9. Click the File Realm tab.

10. In the Caching Realm attribute, choose the name of the Caching realm to be used with the custom security realm. A list of configured Caching realms appears on the pull-down menu.

11. Reboot WebLogic Server.

Adding A Note To A Custom Security Realm

1. Click on the Custom Realm --> Notes tab under the Configuration tab.

2. Write any pertinent information in the Notes field.

3. Click Apply to save your changes.

Defining Users in the CompatibilityRealm

Note: This section explains how to add users to the File realm. If you are using an alternate security realm, you must use the administration tools provided in that realm to define a user.

1. Expand the Compatibility Security node.

2. Click Users.

   The User Configuration window appears.

3. In the User Configuration window, enter the name of the user in the Name attribute.

4. Enter a password for the user in the Password attribute.

5. Enter the password again in the Confirm Password attribute.

6. Click Create.

Deleting Users

1. Expand the Compatibility Security node.

2. Click Users.

   The User Configuration window appears.

3. Enter the name of the user in the Delete Users box on the User Configuration window.

4. Click Delete.

Changing the Password of a User

1. Expand the Compatibility Security node.

2. Click Users.

   The User Configuration window appears.

3. Enter the name of the user in the Name attribute on the User Configuration window.

4. Enter the old password in the Old Password attribute.

5. Enter the new password in the New Password attribute.

6. Enter the new password again to confirm the password change.

Unlocking A User Account

1. Expand the Compatibility Security node.

2. Click Users.

   The User Configuration window appears.

3. Click the Unlock Users link.

4. Enter the names of the user accounts you want to unlock in the Users to Unlock field.

5. Choose the servers on which you want the user accounts unlocked.

6. Click Unlock.

Disabling the Guest User

For a more secure deployment, BEA recommends running WebLogic Server with the guest account disabled.

1. Expand the Domains node.

2. Click the Security tab.

3. Click the General tab.

4. Check the Guest Disable checkbox.

5. Reboot WebLogic Server.

Disabling the guest account just disables the ability to log in into the account guest; it does not disable the ability for unauthenticated users to access a WebLogic Server deployment.

Defining Groups in the CompatibilityRealm

Note: This section describes how to add groups to the version File realm. If you are using an alternate security realm, you need to use the management tools provided in that realm to define a group.

1. Expand the Compatibility Security node.

2. Click Groups.

3. Click the Create a New Group... link.

   The Group Configuration window appears.

4. Enter the name of the group in the Name attribute on the Group Configuration window. BEA recommends naming groups in the plural. For example, Administrators instead of Administrator.

5. Click on the Users attribute and select the WebLogic Server users you want to add to the group.

6. Click on the Groups attribute and select the WebLogic Server Groups you want to add to the Group.

7. Click Apply to create a new Group.

If you are using Compatibility mode and the performance time for authenticating users and groups is taking longer, set the Group Membership Cache TTL attribute for your LDAP server to 0. This should improve performance. If you do not notice improved lookup times, BEA recommends upgrading to one of the Authentication providers.

Deleting Groups

To delete groups, enter the name of the group in the Remove These Groups list box on the Group Configuration window and click Remove.

Defining ACLs in the CompatibilityRealm

To create ACLs:

1. Expand the Compatibility Security node.

2. Click the ACLs tab.

3. Click the Create a New ACL... link.

   The ACL Configuration window appears.

4. Specify the name of WebLogic Server resource that you want to protect with an ACL in the New ACL Name attribute.

   For example, create an ACL for a JDBC connection pool named demopool.

5. Click Create.

6. Click on the Add a New Permission link.

7. Specify a permission for the resource.

   You can either create separate ACLs for each permission available for a resource or one ACL that grants all the permissions for a resource. For example, you can create three ACLs for the JDBC connection pool, demopool: one with reserve permission, one with reset permission, and one with shrink permission. Or you can create one ACL with reserve, reset, and shrink permissions.

8. Specify Weblogic users or groups that have the specified permission to the resource.

9. Click Apply.

Protecting User Accounts

Weblogic Server provides a set of attributes to protect user accounts from intruders. By default, these attributes are set for maximum protection. As a system administrator, you have the option of turning off all the attributes, increasing the number of login attempts before a user account is locked, increasing the time period in which invalid login attempts are made before locking the user account, and changing the amount of time a user account is locked. Remember that changing the attributes lessens security and leaves user accounts vulnerable to security attacks.

To protect the user accounts in your WebLogic Server domain, perform the following steps:

1. Click on the Domains node.

2. Select the Security-->Passwords tab.

3. Define the desired attributes on this tab by entering values at the appropriate prompts and selecting the required checkboxes.

4. Click Apply to save your choices.

5. Reboot WebLogic Server.

There are two sets of attributes available to protect user accounts, one set at the domain and one set at the security realm. You may notice that if you set one set of attributes (for example, the attributes for the security realm) and exceed any of the values, the user account is not locked. This happens because the user account attributes at the domain override the user account attributes at the security realm. To avoid this situation, disable the user account attributes at the security realm.

To disable the user account attributes at the security realm:

1. Expand the Security-->Realms nodes.

2. Expand the CompatibilityRealm node.

3. Select the User Lockout tab.

4. Uncheck the Lockout Enabled attribute.

5. Click Apply.

6. Reboot WebLogic Server.

Warning: If you disable the user lockout attribute at the security realm, you must set the user attributes on the domain otherwise the user accounts will not be protected.