Configuration Auditing Enabling Configuration Auditing

Configuring WebLogic Security Providers 4-9

4.7.2 Configuration Auditing

You can configure the Administration Server to emit log messages and generate audit events when a user changes the configuration of any resource within a domain or invokes management operations on any resource within a domain. For example, if a user disables SSL on a Managed Server in a domain, the Administration Server emits log messages. If you have enabled the WebLogic Auditing provider, it writes the audit events to an additional security log. These messages and audit events provide an audit trail of changes within a domains configuration configuration auditing. The Administration Server writes configuration auditing messages to its local log file. They are not written to the domain-wide message log by default. Note that configuration audit information is contained in Authorization Events. As a result, another approach to configuration auditing is to consume Authorization Events. Note, however, that the information in an Authorization Event tells you whether access was allowed to perform a configuration change; it does not tell you whether the configuration change actually succeeded for instance, it might have failed because it was invalid.

4.7.3 Enabling Configuration Auditing

Enable configuration auditing by one of these methods: ■ Use the Administration Console. Select the Configuration General page for your domain and set the Configuration Audit Type. See Enable configuration auditing in the Oracle WebLogic Server Administration Console Help. ■ When you start the Administration Server, include one of the following Java options in the weblogic.Server command: – -Dweblogic.domain.ConfigurationAuditType=audit Causes the domain to emit Audit Events only. – -Dweblogic.domain.ConfigurationAuditType=log Causes the domain to write configuration auditing messages to the Administration Server log file only. – -Dweblogic.domain.ConfigurationAuditType=logaudit com.bea.contextelement. saml.SSLClientCertificateChain SSL client certificate chain obtained from the SSL connection over which a sender-vouches SAML assertion was received. java.security.cert.X509Certificate[] com.bea.contextelement. saml.MessageSignerCertificate Certificate used to sign a Web services message. java.security.cert.X509Certificate com.bea.contextelement. saml.subject.ConfirmationMetho d Type of SAML assertion: bearer, artifact, sender-vouches, or holder-of-key. java.lang.String com.bea.contextelement. saml.subject.dom.KeyInfo ds:KeyInfo element to be used for subject confirmation with holder-of-key SAML assertions. org.w3c.dom.Element Table 4–2 Cont. Context Handler Entries for Auditing Context Element Name Description and Type 4-10 Securing Oracle WebLogic Server Causes the domain to emit Audit Events and write configuration auditing messages to the Administration Server log file. See weblogic.Server Command-Line Reference in Command Reference for Oracle WebLogic Server. ■ Use the WebLogic Scripting Tool to change the value of the ConfigurationAuditType attribute of the DomainMBean. See Oracle WebLogic Scripting Tool.

4.7.4 Configuration Auditing Messages