Deployment Descriptors and the WebLogic Server Administration Console

Overview of Security Management 2-5 stateless session EJB, particular methods in that EJB, the Web application that contains the web-services.xml file, and so on. ■ Remote resources.

2.3.2 Deployment Descriptors and the WebLogic Server Administration Console

WebLogic Server offers a choice of models for configuring security roles and policies. Under the standard Java Enterprise Edition model, you define role mappings and policies in the Web application or EJB deployment descriptors. The WebLogic Security Service can use information defined in deployment descriptors to grant security roles and define security policies for Web applications and EJBs. When WebLogic Server is booted for the first time, security role and security policy information stored in web.xml, weblogic.xml, ejb-jar.xml, or weblogic-ejb-jar.xml deployment descriptors is loaded into the Authorization and Role Mapping providers configured in the default security realm. You can then view the role and policy information from the Administration Console. Optionally, you may configure the security realm to use a different security model that allows you to make changes to that information via the Administration Console as well. To use information in deployment descriptors, at least one Authorization and Role Mapping provider in the security realm must implement the DeployableAuthorizationProvider and DeployableRoleProvider Security Service Provider Interface SSPI. This SSPI allows the providers to store rather than retrieve information from deployment descriptors. By default, the WebLogic Authorization and Role Mapping providers implement this SSPI. If you change security role and security policy in deployment descriptors through the Administration Console and want to continue to modify this information through the Administration Console, you can set configuration options on the security realm to ensure changes made through the Console are not overwritten by old information in the deployment descriptors when WebLogic Server is rebooted. For more information, see Options for Securing Web Application and EJB Resources in Securing Resources Using Roles and Policies for Oracle WebLogic Server.

2.4 The Default Security Configuration in WebLogic Server