Configuring a Domain to Use JAAS Authorization

13-8 Securing Oracle WebLogic Server For information about unlocking a locked user account, see Unlock user accounts in the Oracle WebLogic Server Administration Console Help. Unlocking a locked user account can be done through either the WebLogic Administration Console or the clearLockout attribute on the UserLockoutManagerRuntimeMBean.

13.8 Configuring a Domain to Use JAAS Authorization

The security configuration in a WebLogic domain can be modified to use JAAS authorization, which interprets Subjects differently from the way in which the WebLogic Security Service does. For example, when a principal requests access to a resource that is protected by the Java policy provider in Oracle Platform Security Services OPSS, the principal is compared to another principal that is built from a name contained in a policy store. This comparison occurs when the Principal.equals method is invoked. If the appropriate attributes of the two principal objects match, access is granted. Principal comparison is not used by the WebLogic Security Service to determine access decisions to protected resources. However, when principal comparison is performed in a default WebLogic domain, the comparison of principal names is case sensitive, and only the names of the principals are compared. To use JAAS authorization, the security configuration of a WebLogic domain can be modified to accommodate the following principal comparison behavior: ■ The comparison of principal names is case insensitive ■ The GUID and DN data in WebLogic principal objects are included in the comparison To modify the security configuration of a WebLogic domain so that principal objects can be used with JAAS authorization, the following MBean attributes settings are available: SecurityConfigurationMBean.PrincipalEqualsCaseInsensitive=true SecurityConfigurationMBean.PrincipalEqualsCompareDnAndGuid=true To set these attributes in the WebLogic Server Administration Console:

1. In the left pane of the Console, under Domain Structure, select the domain name.

2. Select Configuration Security and click Advanced.

3. Select the check box next to each of the following entries: Notes: The User Lockout options apply to the default security realm and all its security providers. The User Lockout options do not work with custom security providers in a security realm other than the default security realm. To use the User Lockout options with custom security providers, configure the custom security providers in the default security realm. Include the customer providers in the authentication process after the Default Authentication provider and the WebLogic Identity Assertion provider. This ordering may cause a small performance hit. If you are using an Authentication provider that has its own mechanism for protecting user accounts, disable Lockout Enabled. If a user account becomes locked and you delete the user account and add another user account with the same name and password, the User Lockout configuration options will not be reset. Configuring Security for a WebLogic Domain 13-9 ■ Principal Equals Case Insensitive ■ Principal Equals Compare DN and GUID For information about principal comparison in the Oracle Platform Security Service, see Principal Name Comparison Logic in Oracle Fusion Middleware Security Guide. For information about passing identity to a WebLogic domain, see Programming Stand-alone Clients for Oracle WebLogic Server. Note: If a domain is configured to use the GUID and DN data in principals, there may be an impact when interoperating with other WebLogic domains, particularly older domains, resulting from changes made to the way identity is passed. 13-10 Securing Oracle WebLogic Server 14 Using Compatibility Security 14-1 14 Using Compatibility Security Compatibility security is the capability to run security configurations developed with WebLogic Server 6.x in this release of WebLogic Server. In Compatibility security, you manage 6.x security realms, users, groups, and ACLs, protect user accounts, and configure the Realm Adapter Auditing provider and optionally the Identity Assertion provider in the Realm Adapter Authentication provider. The following sections describe how to configure Compatibility security: ■ Section 14.1, Running Compatibility Security: Main Steps