Setting Application-Type Security Policies Setting Application-Specific Security Policies
8.2.1.2 Setting Application-Type Security Policies
Set default security policies for Servlets, EJBs, and Java EE Connector Resource Adapters in the Java security policy file. The default security policies for Servlets, EJBs, and Resource Adapters are defined in the Java security policy file under the following codebases: ■ Servlets—file:weblogicapplicationdefaultsWeb ■ EJBs—file:weblogicapplicationdefaultsEJB ■ Resource Adapters—file:weblogicapplicationdefaultsConnector8.2.1.3 Setting Application-Specific Security Policies
Set security policies for a specific Servlet, EJB, or Resource Adapter by adding security policies to their deployment descriptors. Deployment descriptors are defined in the following files: ■ Servlets—weblogic.xml ■ EJBs—weblogic-ejb-jar.xml ■ Resource Adapters—rar.xml Example 8–2 shows the syntax for adding a security policy to a deployment descriptor: Example 8–2 Security Policy Syntax security-permission description Caution: The Java Security Manager is partially disabled during the booting of Administration and Managed Servers. During the boot sequence, the current Java Security Manager is disabled and replaced with a variation of the Java Security Manager that has the checkRead method disabled. While disabling this method greatly improves the performance of the boot sequence, it also minimally diminishes security. The startup classes for WebLogic Server are run with this partially disabled Java Security Manager and therefore the classes need to be carefully scrutinized for security considerations involving the reading of files. Note: These security policies apply to all Servlets, EJBs, and Resource Adapters deployed in the particular instance of WebLogic Server. Note: The security policies for Resource Adapters follow the Java EE standard while the security policies for Servlets and EJBs follow the WebLogic Server extension to the Java EE standard. Using Java Security to Protect WebLogic Resources 8-5 Allow getting the J2EEJ2SETest4 property description security-permission-spec grant { permission java.util.PropertyPermission welcome.J2EEJ2SETest4,read; }; security-permission-spec security-permission8.2.2 Using Printing Security Manager
Parts
» Oracle Fusion Middleware Online Documentation Library
» Document Scope Audience for This Guide
» Guide to this Document Related Information
» New and Changed Security Features in This Release What Is Security?
» Authentication Authorization Java EE Security
» User Name and Password Authentication
» Digital Certificate Authentication Authentication With Web Browsers
» Using Secure Cookies to Prevent Session Stealing
» Developing BASIC Authentication Web Applications
» Using WLST to Check the Value of enforce-valid-basic-auth-credentials
» Developing FORM Authentication Web Applications
» Developing Swing-Based Authentication Web Applications Deploying Web Applications
» auth-constraint security-constraint web.xml Deployment Descriptors
» security-role security-role-ref user-data-constraint web.xml Deployment Descriptors
» externally-defined weblogic.xml Deployment Descriptors
» security-permission-spec security-role-assignment weblogic.xml Deployment Descriptors
» getUserPrincipal isUserInRole Using Programmatic Security With Web Applications
» JAAS Authentication APIs JAAS Authentication Development Environment
» JAAS Client Application Components
» WebLogic LoginModule Implementation JVM-Wide Default User and the runAs Method
» Writing a Client Application Using JAAS Authentication
» Using JNDI Authentication Oracle Fusion Middleware Online Documentation Library
» Java Client JAAS Authentication Code Examples JSSE and WebLogic Server
» SSL Authentication APIs SSL Certificate Authentication Development Environment
» SSL Client Application Components
» SSLClient Sample SSLSocketClient Sample
» Two-Way SSL Authentication with JNDI
» Using Two-Way SSL Authentication Between WebLogic Server Instances
» Using Two-Way SSL Authentication with Servlets
» Using the CertPath Trust Manager Using a Handshake Completed Listener
» Using an SSLContext Using URLs to Make Outbound SSL Connections
» Declarative Authorization Programmatic Authorization
» SSL Client Code Examples Using Declarative Security With EJBs
» method method-permission ejb-jar.xml Deployment Descriptors
» role-name run-as security-identity ejb-jar.xml Deployment Descriptors
» security-role security-role-ref ejb-jar.xml Deployment Descriptors
» externally-defined weblogic-ejb-jar.xml Deployment Descriptors
» identity-assertion iiop-security-descriptor integrity principal-name
» role-name run-as-identity-principal weblogic-ejb-jar.xml Deployment Descriptors
» run-as-principal-name run-as-role-assignment weblogic-ejb-jar.xml Deployment Descriptors
» security-permission security-permission-spec security-role-assignment transport-requirements
» ConnectionFilterImpl Class ConnectionEvent Class
» Connection Filter Rules Syntax Types of Connection Filter Rules
» Modifying the weblogic.policy file for General Use
» Setting Application-Type Security Policies Setting Application-Specific Security Policies
» Using Java EE Security to Protect WebLogic Resources SAML API Description
» Custom POST Form Parameter Names
» Overview of Creating a Custom SAML Name Mapper
» SAMLAttributeStatementInfo Class Classes, Interfaces, and Methods
» SAMLCredentialAttributeMapper Interface Classes, Interfaces, and Methods
» Make the Custom SAMLCredentialAttributeMapper Class Available in the Console
» What Are SAML SSO Attributes?
» How to Implement SAML Attributes
» Example Custom SAML 2.0 Credential Attribute Mapper
» Custom SAML 2.0 Identity Asserter Attribute Mapper
» Example Custom SAML 1.1 Credential Attribute Mapper
» Custom SAML 1.1 Identity Asserter Attribute Mapper
» Instantiate a CertPathSelector CertPath Building
» Instantiate a CertPathBuilderParameters CertPath Building
» Use the JDK CertPathBuilder Interface Example Code Flow for Looking Up a Certificate Chain
Show more