Using Debugging with JSSE SSL

12-18 Securing Oracle WebLogic Server

12.12.4 Using Debugging with JSSE SSL

As described in Section 12.6, SSL Debugging, SSL debugging provides more detailed information about the SSL events that occurred during an SSL handshake and other operations. If you debug SSL when the JSSE-based SSL implementation is enabled, you can use the same debug logging properties as when the Certicom SSL implementation is enabled. These logging properties are listed and described in Table 12–2 . However, when the JSSE-based SSL implementation is enabled, some properties affect only the SSL calling code and not the JSSE implementation. The JSSE-based SSL implementation has its own logging system, which is activated by the javax.net.debug property. The javax.net.debug property provides multiple levels of control over the amount of output and can be used independently of WebLogic SSL logging ssl.debug. See the Debugging Utilities section of the Java Secure Socket Extension JSSE Reference Guide, available at the following URL, for more details about the javax.net.debug property: http:download.oracle.comjavase6docstechnotesguidessecuri tyjsseJSSERefGuide.htmlDebug Table 12–3 Cipher Suite Name Equivalence Certicom Cipher Suite SunJSSE Equivalent Cipher Suite TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA SSL_DH_anon_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_WITH_DES_CBC_SHA SSL_DH_anon_WITH_DES_CBC_SHA TLS_DH_anon_WITH_RC4_128_MD5 SSL_DH_anon_WITH_RC4_128_MD5 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 TLS_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA TLS_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_SHA 13 Configuring Security for a WebLogic Domain 13-1 13 Configuring Security for a WebLogic Domain The following sections describe how to set security configuration options for a WebLogic domain: ■ Section 13.1, Important Information Regarding Cross-Domain Security Support ■ Section 13.2, Enabling Trust Between WebLogic Server Domains ■ Section 13.3, Using Connection Filters ■ Section 13.4, Using the Java Authorization Contract for Containers ■ Section 13.5, Viewing MBean Attributes ■ Section 13.6, How Passwords Are Protected in WebLogic Server ■ Section 13.7, Protecting User Accounts ■ Section 13.8, Configuring a Domain to Use JAAS Authorization

13.1 Important Information Regarding Cross-Domain Security Support

This section describes important information regarding support for the cross-domain security solution. As described in Section 13.2, Enabling Trust Between WebLogic Server Domains, cross-domain security establishes trust between domains such that principals in a subject from one WebLogic domain can make calls in another domain. WebLogic Server establishes a security role for cross-domain users, and uses the WebLogic Credential Mapping security provider in each domain to store the credentials to be used by the cross-domain users. In this release of WebLogic Server, subsystems such as JMS, JTA, MDB, and WAN replication implement cross-domain security. These subsystems can authenticate and send the required credentials across domains. However, the EJB container does not implement the solution for cross-domain security. As a result, the WLS cross-domain security feature does not work in the following situations: ■ WLI domain ■ With ALSB, when ALSB is configured to use the SB and DSP transports. ■ ALDSP domain Note: These sections apply to WebLogic Server deployments using the security features in this release of WebLogic Server as well as deployments using Compatibility Security.