Configuring a Realm Adapter Authentication Provider

Using Compatibility Security 14-3 security by configuring the Identity Assertion provider in the Realm Adapter Authentication provider. For more information, see Section 14.5, Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider. ■ Access Control Lists ACLs in the 6.x security realm are used to populate the Realm Adapter Authorization provider. ■ The Realm Adapter Adjudication provider enables the use of both ACLs and security roles and security policies in Compatibility security. The Realm Adapter Adjudication provider can be used only with the Realm Adapter Authentication provider and the WebLogic Authorization provider. It resolves access decision conflicts between ACLs and new security policies set through the Administration Console. The Realm Adapter Adjudication provider permits access if the one authorization provider votes PERMIT and the other authorization provider votes DENY. ■ The WebLogic Credential Mapping provider allows the use of credential maps in Compatibility security. For more information, see Programming Resource Adapters for Oracle WebLogic Server. ■ You can add a Realm Adapter Auditing provider to access implementations of the weblogic.security.audit.AuditProvider class from the CompatibilityRealm. For more information, see Configure a Realm Adapter Auditing Provider in the Oracle WebLogic Server Administration Console Help.

14.4 Configuring a Realm Adapter Authentication Provider

When using Compatibility security, a Realm Adapter Authentication provider is by default configured for the CompatibilityRealm. For information about using the Realm Adapter Authentication provider in the CompatibilityRealm, see Section 14.3, The Default Security Configuration in the CompatibilityRealm. The Realm Adapter Authentication provider also allows use of implementations of the weblogic.security.acl.CertAuthenticator class with this release of WebLogic Server. The Realm Adapter Authentication provider includes an Identity Assertion provider that asserts identity based on X.509 tokens. For information about using a CertAuthenticator with WebLogic Server, Section 14.5, Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider. When you add a Realm Adapter Authentication provider to a security realm with an Authentication provider already configured, WebLogic Server sets the JAAS Control Flag on the Realm Adapter Authentication provider to OPTIONAL and checks for the presence of a fileRealm.properties file in the domain directory. WebLogic Server will not add the Realm Adapter Authentication provider to the security realm if the fileRealm.properties file does not exist. Note: The subjects produced by the Realm Adapter Authentication provider do not contain principals for the groups to which a user belongs. Use the weblogic.security.SubjectUtils.isUserInGroup method to determine whether a user is in a group. When you use subjects produced by the Realm Adapter Authentication provider, you cannot iterate the complete set of groups to which a user belongs. 14-4 Securing Oracle WebLogic Server

14.5 Configuring the Identity Assertion Provider in the Realm Adapter Authentication Provider