Setting the JAAS Control Flag Option Changing the Order of Authentication Providers

Configuring Authentication Providers 5-3

5.2.1 Setting the JAAS Control Flag Option

When you configure multiple Authentication providers, use the JAAS Control Flag for each provider to control how the Authentication providers are used in the login sequence. You can set the JAAS Control Flag in the WebLogic Administration Console. See Set the JAAS control flag in the Oracle WebLogic Server Administration Console Help. You can also use the WebLogic Scripting Tool or Java Management Extensions JMX APIs to set the JAAS Control Flag for an Authentication provider. JAAS Control Flag values are: ■ REQUIRED—The Authentication provider is always called, and the user must always pass its authentication test. Regardless of whether authentication succeeds or fails, authentication still continues down the list of providers. ■ REQUISITE—The user is required to pass the authentication test of this Authentication provider. If the user passes the authentication test of this Authentication provider, subsequent providers are executed but can fail except for Authentication providers with the JAAS Control Flag set to REQUIRED. ■ SUFFICIENT—The user is not required to pass the authentication test of the Authentication provider. If authentication succeeds, no subsequent Authentication providers are executed. If authentication fails, authentication continues down the list of providers. ■ OPTIONAL—The user is allowed to pass or fail the authentication test of this Authentication provider. However, if all Authentication providers configured in a security realm have the JAAS Control Flag set to OPTIONAL, the user must pass the authentication test of one of the configured providers. When additional Authentication providers are added to an existing security realm, by default the Control Flag is set to OPTIONAL. If necessary, change the setting of the Control Flag and the order of Authentication providers so that each Authentication provider works properly in the authentication sequence.

5.2.2 Changing the Order of Authentication Providers

The order in which WebLogic Server calls multiple Authentication providers can affect the overall outcome of the authentication process. The Authentication Providers table lists the authentication providers in the order in which they will be called. By default, Authentication providers are called in the order in which they were configured. You can use the Administration Console to change the order of Authentication providers. Select the Reorder button on the Security Realms RealmName Providers Authentication page in the Administration Console to change the order in which Authentication providers are called by WebLogic Server and listed in the console. See Re-order Authentication Providers in the Oracle WebLogic Server Administration Console Help.

5.3 Configuring the WebLogic Authentication Provider