Security Providers that Use the RDBMS Security Store

10 Managing the RDBMS Security Store 10-1 10 Managing the RDBMS Security Store WebLogic Server provides the option of using an external RDBMS as a datastore that is used by authorization, role mapping, credential mapping, and certificate registry providers. This datastore, called the RDBMS security store, is strongly recommended for the use of SAML 2.0 services in two or more WebLogic Server instances in that domain, such as in a cluster. The following sections explain how to configure and manage the RDBMS security store: ■ Section 10.1, Security Providers that Use the RDBMS Security Store ■ Section 10.2, Configuring the RDBMS Security Store ■ Section 10.3, Upgrading a Domain to Use the RDBMS Security Store For the most up-to-date details about the specific database systems that are supported for use as the RDBMS security store for WebLogic Server, see the Oracle Fusion Middleware Supported System Configurations page at http:www.oracle.comtechnologysoftwareproductsiasfilesfus ion_certification.html .

10.1 Security Providers that Use the RDBMS Security Store

The following security providers use the RDBMS security store if that store is configured in a domain: ■ XACML Authorization provider ■ XACML Role Mapping provider ■ The following providers for SAML 1.1: – SAML Identity Assertion provider V2 – SAML Credential Mapping provider V2 ■ The following providers for SAML 2.0: – SAML 2.0 Identity Assertion provider Note: In order to use the RDBMS security store, the preferred approach is first to create a domain in which the external RDBMS server is configured. Prior to booting the domain, you create the tables in the datastore that are required by the RDBMS security store. The WebLogic Server installation directory contains a set of SQL scripts that create these tables for each supported database. 10-2 Securing Oracle WebLogic Server – SAML 2.0 Credential Mapping provider ■ WebLogic Credential Mapping provider ■ PKI Credential Mapping provider ■ Certificate Registry When the RDBMS security store is configured in a domain, an instance of any of the preceding security providers that has been created in the security realm automatically uses only the RDBMS security store as a datastore, and not the embedded LDAP server. WebLogic security providers configured in the domain that are not among those in the preceding list continue to use their respective default stores; for example, the Default Authentication provider continues to use the embedded LDAP server. Oracle recommends that you configure the RDBMS security store at the time of domain creation. The Configuration Wizard has been enhanced to simplify this process. This utility includes an option for testing the RDBMS connection to help ensure that when the domain is booted, the security policies required to access the domain can be retrieved. In addition to the Configuration Wizard, WebLogic Server also contains the RDBMSSecurityStoreMBean, which is the interface for configuring the RDBMS security store via the WebLogic Scripting Tool WLST.

10.2 Configuring the RDBMS Security Store