The Authenticated Role Oracle Fusion Middleware Online Documentation Library

2-10 Oracle Fusion Middleware Application Security Guide It is therefore crucial that principal names be compared properly for the authorization provider to work as expected. Suppose, for instance, a scenario where the identity store contains the user name jdoe, but, in grants, that user is referred to as Jdoe. Then one would want the principal name comparison to be case insensitive, for otherwise the principals built from the names jdoe and Jdoe will not match that is, they will be considered distinct and the system will not authorize jdoe as expected.

2.7.2 System Parameters Controlling Principal Name Comparison

The following two WebLogic Server system parameters control the way principal names are compared in a domain and allow, furthermore, to compare principals using DN and GUID data: PrincipalEqualsCaseInsensitive True or False; False by default PrincipalEqualsCompareDnAndGuid True or False; False by default To set these parameters using the WebLogic Server Console, proceed as follows:

1. In the left pane of the Console, under Domain Structure, select the domain for

which you intend to set the parameters above.

2. Select Configuration Security and click Advanced.

3. Check to set to true or uncheck to set to false the box next to the following entries: ■ Principal Equals Case Insensitive ■ Principal Equals Compare DN and GUID 4. Restart the server. Changes do not take effect until the server is restarted. These parameters can alternatively be set using OPSS scripts. For more details about configuring the WebLogic server, see section Configuring a Domain to Use JAAS Authorization in Oracle Fusion Middleware Securing Oracle WebLogic Server. The name comparison logic chosen at runtime is described by the following pseudo-code fragment: if PrincipalEqualsCompareDnAndGuid is true use GUID and DN to compare principals { when GUID is present in both principals { use case insensitive to compare GUIDs } when DN is present in both principals { use case insensitive to compare DNs } } if PrincipalEqualsCaseInsensitive is true use just name to compare principals { use case insensitive to compare principal names } else { use case sensitive to compare principal names }