New and Changed Security Features Security Realms in WebLogic Server

1-4 Securing Oracle WebLogic Server online help describes configuration procedures and provides a reference for configurable attributes. ■ Upgrade Guide for Oracle WebLogic Server—Provides procedures and other information you need to upgrade from earlier versions of WebLogic Server to this release. It also provides information about moving applications from an earlier version of WebLogic Server to this release. For specific information on upgrading WebLogic Server security, see Upgrading a Security Provider in Upgrade Guide for Oracle WebLogic Server. ■ Oracle WebLogic Server API Reference—Provides reference documentation for the WebLogic security packages that are provided with and supported by this release of WebLogic Server.

1.5 Security Samples and Tutorials

In addition to the documents listed in Section 1.4, Related Information, Oracle provides a variety of code samples for developers, some packaged with WebLogic Server and others available at the Oracle Technology Network OTN at https:www.samplecode.oracle.com .

1.5.1 Security Examples in the WebLogic Server Distribution

WebLogic Server optionally installs API code examples in WL_ HOME \samples\server\examples\src\examples\security, where WL_HOME is the top-level directory of your WebLogic Server installation. To install the examples, when you install WebLogic Server choose the Custom installation option and make sure that the Server examples checkbox is checked. You can start the examples server, and obtain information about the samples and how to run them from the WebLogic Server Start menu. The following examples illustrate WebLogic security features: ■ Java Authentication and Authorization Service ■ Outbound and Two-way SSL

1.5.2 Additional Examples Available for Download

Additional WebLogic Server security examples are available for download at the Oracle Technology Network OTN at https:codesamples.samplecode.oracle.com . These examples are distributed as .zip files that you can unzip into an existing WebLogic Server samples directory structure. You build and run the downloadable examples in the same manner as you would an installed WebLogic Server example. See the download pages of individual examples for more information.

1.6 New and Changed Security Features

For a comprehensive listing of the new WebLogic Server features introduced in this release, see Whats New in Oracle WebLogic Server. 2 Overview of Security Management 2-1 2 Overview of Security Management The following sections provide an overview of the security system for WebLogic Server. For a broader overview, see Understanding Security for Oracle WebLogic Server. ■ Section 2.1, Security Realms in WebLogic Server ■ Section 2.2, Security Providers ■ Section 2.3, Security Policies and WebLogic Resources ■ Section 2.4, The Default Security Configuration in WebLogic Server ■ Section 2.5, Configuring WebLogic Security: Main Steps ■ Section 2.6, Methods of Configuring Security ■ Section 2.7, What Is Compatibility Security?

2.1 Security Realms in WebLogic Server

The security service in WebLogic Server simplifies the configuration and management of security while offering robust capabilities for securing your WebLogic Server deployment. Security realms act as a scoping mechanism. Each security realm consists of a set of configured security providers, users, groups, security roles, and security policies. You can configure multiple security realms in a domain; however, only one can be the active security realm. WebLogic Server provides two default security realms: ■ myrealm—Has the WebLogic Adjudication, Authentication, Identity Assertion, Authorization, Role Mapping, and Credential Mapping providers configured by default. ■ CompatibilityRealm—Provides backward compatibility for 6.x security configurations. You can access an existing 6.x security configuration through the CompatibilityRealm. You can customize authentication and authorization functions by configuring a new security realm to provide the security services you want and then set the new security realm as the default security realm. For information about the default security configuration in WebLogic Server, see Section 2.4, The Default Security Configuration in WebLogic Server. For information about configuring a security realm and setting it as the default security realm, see Chapter 3, Customizing the Default Security Configuration. Note: Throughout this document, the term 6.x refers to WebLogic Server 6.0 and 6.1 and their associated service packs. 2-2 Securing Oracle WebLogic Server For information about Compatibility security, see Chapter 14, Using Compatibility Security.

2.2 Security Providers