WebLogic Resources Security Policies and WebLogic Resources

2-4 Securing Oracle WebLogic Server

2.3 Security Policies and WebLogic Resources

WebLogic Server uses security policies which replace the ACLs and permissions used in WebLogic Server 6.x to protect WebLogic resources. Security policies answer the question who has access to a WebLogic resource. A security policy is created when you define an association between a WebLogic resource and a user, group, or security role. You can also optionally associate a time constraint with a security policy. A WebLogic resource has no protection until you assign it a security policy. Creating security policies is a multi-step process with many options. To fully understand this process, read Securing Resources Using Roles and Policies for Oracle WebLogic Server. That document should be used in conjunction with Securing WebLogic Security to ensure security is completely configured for a WebLogic Server deployment.

2.3.1 WebLogic Resources

A WebLogic resource is a structured object used to represent an underlying WebLogic Server entity, which can be protected from unauthorized access. WebLogic Server defines the following resources: ■ Administrative resources such as the WebLogic Server Administration Console and WebLogic Scripting Tool. ■ Application resources that represent Enterprise applications. This type of resource includes individual EAR Enterprise Application aRchive files and individual components, such as EJB JAR files contained within the EAR. ■ Component Object Model COM resources that are designed as program component objects according to Microsofts framework. This type of resource includes COM components accessed through the Oracle bidirectional COM-Java jCOM bridging tool. ■ Enterprise Information System EIS resources that are designed as resource adapters, which allow the integration of Java applications with existing enterprise information systems. These resource adapters are also known as connectors. ■ Enterprise JavaBean EJB resources including EJB JAR files, individual EJBs within an EJB JAR, and individual methods on an EJB. ■ Java DataBase Connectivity JDBC resources including groups of connection pools, individual connection pools, and multipools. ■ Java Naming and Directory Interface JNDI resources. ■ Java Messaging Service JMS resources. ■ Server resources related to WebLogic Server instances, or servers. This type of resource includes operations that start, shut down, lock, or unlock servers. ■ URL resources related to Web applications. This type of resource can be a Web Application aRchive WAR file or individual components of a Web application such as servlets and JSPs. ■ Web services resources related to services that can be shared by and used as components of distributed, Web-based applications. This type of resource can be an entire Web service or individual components of a Web service such as a Note: Web resources are deprecated. Use the URL resource instead. Overview of Security Management 2-5 stateless session EJB, particular methods in that EJB, the Web application that contains the web-services.xml file, and so on. ■ Remote resources.

2.3.2 Deployment Descriptors and the WebLogic Server Administration Console