Setting Application-Type Security Policies Setting Application-Specific Security Policies

8-4 Programming Security for Oracle WebLogic Server For more information about the Java Security Manager, see the Javadoc for the java.lang.SecurityManager class, available at http:java.sun.comjavase6docsapijavalangSecurityManager. html .

8.2.1.2 Setting Application-Type Security Policies

Set default security policies for Servlets, EJBs, and Java EE Connector Resource Adapters in the Java security policy file. The default security policies for Servlets, EJBs, and Resource Adapters are defined in the Java security policy file under the following codebases: ■ Servlets—file:weblogicapplicationdefaultsWeb ■ EJBs—file:weblogicapplicationdefaultsEJB ■ Resource Adapters—file:weblogicapplicationdefaultsConnector

8.2.1.3 Setting Application-Specific Security Policies

Set security policies for a specific Servlet, EJB, or Resource Adapter by adding security policies to their deployment descriptors. Deployment descriptors are defined in the following files: ■ Servlets—weblogic.xml ■ EJBs—weblogic-ejb-jar.xml ■ Resource Adapters—rar.xml Example 8–2 shows the syntax for adding a security policy to a deployment descriptor: Example 8–2 Security Policy Syntax security-permission description Caution: The Java Security Manager is partially disabled during the booting of Administration and Managed Servers. During the boot sequence, the current Java Security Manager is disabled and replaced with a variation of the Java Security Manager that has the checkRead method disabled. While disabling this method greatly improves the performance of the boot sequence, it also minimally diminishes security. The startup classes for WebLogic Server are run with this partially disabled Java Security Manager and therefore the classes need to be carefully scrutinized for security considerations involving the reading of files. Note: These security policies apply to all Servlets, EJBs, and Resource Adapters deployed in the particular instance of WebLogic Server. Note: The security policies for Resource Adapters follow the Java EE standard while the security policies for Servlets and EJBs follow the WebLogic Server extension to the Java EE standard. Using Java Security to Protect WebLogic Resources 8-5 Allow getting the J2EEJ2SETest4 property description security-permission-spec grant { permission java.util.PropertyPermission welcome.J2EEJ2SETest4,read; }; security-permission-spec security-permission

8.2.2 Using Printing Security Manager