Before You Create a New Security Realm

3-2 Securing Oracle WebLogic Server ■ Use an Identity Assertion provider that handles SAML assertions or Kerberos tokens. ■ Use the Certificate Registry to add certificate revocation to the security realm. ■ Change the default configuration settings of the security providers. ■ Use a custom Authorization or Role Mapping provider that does not support parallel security policy and role modification, respectively, in the security provider database. For information about configuring different types of security providers in a security realm, see Chapter 4, Configuring WebLogic Security Providers, and Chapter 5, Configuring Authentication Providers. The easiest way to customize the default security configuration is to add the security providers you want to the default security realm myrealm. However, Oracle recommends instead that you customize the default security configuration by creating an entirely new security realm. This preserves your ability to revert more easily to the default security configuration. You configure security providers for the new realm; migrate any security data, such as users as groups, from the existing default realm; and then set the new security realm as the default realm. See Section 3.3, Creating and Configuring a New Security Realm: Main Steps.

3.2 Before You Create a New Security Realm

Before creating a new security realm, you need to decide: ■ Which security providers you want to use. WebLogic Server includes a wide variety of security providers and, in addition, allows you to create or obtain custom security providers. A valid security realm requires an Authentication provider, an Authorization provider, an Adjudication provider, a Credential Mapping provider, a Role Mapping provider, and a CertPathBuilder. In addition, a security realm can optionally include Identity Assertion, Auditing, and Certificate Registry providers. If your new security realm includes two or more providers of the same type for example, more than one Authentication provider or more than one Authorization provider, you need to determine how these providers should interact with each other. See Section 5.2, Using More Than One Authentication Provider. In addition, custom Authorization and Role Mapping providers may or may not support parallel security policy and role modification, respectively, in the security provider database. If your custom Authorization and Role Mapping security providers do not support parallel modification, the WebLogic Security framework can enforce a synchronization mechanism that results in each application and module being placed in a queue and deployed sequentially. To do this, set the Deployable Provider Synchronization Enabled and Deployable Provider Synchronization Timeout controls for the realm. ■ What model to use to set security roles and security policies for Web application and EJB resources. These security roles and policies can be set through deployment descriptors or through the WebLogic Administration Console. See Options for Securing Web Application and EJB Resources in Securing Resources Using Roles and Policies for Oracle WebLogic Server. ■ Whether or not to use the Web resource. The Web resource is deprecated. If you are configuring a custom Authorization provider that uses the Web resource instead of the URL resource in the new security realm, enable Use Deprecated Web Resource on the new security realm. Customizing the Default Security Configuration 3-3 This option changes the runtime behavior of the Servlet container to use a Web resource rather than a URL resource when performing authorization. For more information, see Configure new security realms in the Oracle WebLogic Server Administration Console Help.

3.3 Creating and Configuring a New Security Realm: Main Steps