Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider Configuring a Realm Adapter Auditing Provider Protecting User Accounts in Compatibility Security

14-4 Securing Oracle WebLogic Server

14.5 Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider

The Realm Adapter Authentication provider includes an Identity Assertion provider.The Identity Assertion provider provides backward compatibility for implementations of the deprecated weblogic.security.acl.CertAuthenticator class. The identity assertion is performed on X.509 tokens. By default, the Identity Assertion provider is not enabled in the Realm Adapter Authentication provider. For information about how to enable the Identity Assertion provider, see Enable the Identity Assertion provider in the Oracle WebLogic Server Administration Console Help.

14.6 Configuring a Realm Adapter Auditing Provider

The Realm Adapter Auditing provider allows you to use implementations of the weblogic.security.audit.AuditProvider interface when using Compatibility security. In order for the Realm Adapter Auditing provider to work properly, the implementation of the AuditProvider interface must have been defined. You can define the AuditProvider class using the Administration Console by selecting, in the Audit Provider Class field available from the Domain: Compatibility Security General page. For information, see Configure a Realm Adapter Auditing provider in the Oracle WebLogic Server Administration Console Help.

14.7 Protecting User Accounts in Compatibility Security

Password guessing is a common type of security attack. In this type of attack, a hacker attempts to log in to a computer using various combinations of usernames and passwords. WebLogic Server provides a set of lockout configuration options to protect user accounts from this kind of attack. By default, these options are set for maximum protection. As a system administrator, you have the option of turning off all the options, increasing the number of login attempts before a user account is locked, increasing the time period in which invalid login attempts are made before locking the user account, and changing the amount of time a user account is locked. Remember that changing the configuration options lessens security and leaves user accounts vulnerable to security attacks. There are two sets of configuration options available to protect user accounts, one set at the domain and one set at the security realm. You may notice that if you set one set of configuration options for example, the options for the security realm and exceed any of the values, the user account is not locked. This happens because the user account lockout options at the domain override the user account options at the security realm. To avoid this situation, disable the user account lockout options at the security realm. For information, see Protect user accounts and Unlock user accounts in the Oracle WebLogic Server Administration Console Help. Caution: If you disable the user lockout configuration option at the security realm, you must set the user lockout configuration options on the domain otherwise the user accounts will not be protected. Using Compatibility Security 14-5

14.8 Accessing 6.x Security from Compatibility Security