Subject Types GrantDeny Evaluation Rules

9-8 Securing Oracle WebLogic Server If the keyword [all] and another attribute are both specified within an ACL, the more specific permission for the attribute overrides the less specific permission specified by the [all] keyword.

9.5.6 Subject Types

Access control rules can be associated with a number of subject types. The subject of an access control rule determines whether the access control rule applies to the currently connected session. The following subject types are defined: ■ authzID—Applies to a single user that can be specified as part of the subject definition. The identity of that user in the LDAP directory is typically defined as a DN. ■ Group—Applies to a group of users specified by one of the following object classes: – groupOfUniqueNames – groupOfNames – groupOfUniqueURLs The first two types of groups contain lists of users, and the third type allows users to be included in the group automatically based on defined criteria. ■ Subtree—Applies to the DN specified as part of the subject and all subentries in the LDAP directory tree. ■ IP Address—Applies to a particular Internet address. This subject type is useful when all access must come through a proxy or other server. Applies only to a particular host, not to a range or subnet. ■ Public—Applies to anyone connected to the directory, whether they are authenticated or not. ■ This—Applies to the user whose DN matches that of the entry being accessed.

9.5.7 GrantDeny Evaluation Rules

The decision whether to grant or deny a client access to the information in an entry is based on many factors related to the access control rules and the entry being protected. Throughout the decision making process, these guiding principles apply: ■ More specific rules override less specific ones for example, individual user entries in an ACL take precedence over a group entry. ■ If a conflict still exists in spite of the specificity of the rule, the subject of the rule determines which rule will be applied. Rules based on an IP Address subject are given the highest precedence, followed by rules that are applied to a specific AuthzID or This subject. Next in priority are rules that apply to Group subjects. Last priority is given to rules that apply to Subtree and Public subjects. ■ When there are conflicting ACL values, Deny takes precedence over Grant. ■ Deny is the default when there is no access control information. Additionally, an entry scope takes precedence over a subtree scope. Managing the Embedded LDAP Server 9-9

9.6 Backup and Recovery

If any of your security realms use the Default Authentication, Authorization, Credential Mapping, or Role Mapping providers, you should maintain an up-to-date backup of the following directory tree: domain_name serversadminServerdataldap In the preceding directory, domain_name is the domain root directory and adminServer is the directory in which the Administration Server stores run-time and security data. For more information backing up the embedded LDAP server data, see the following topics: ■ Back Up LDAP Repository in Managing Server Startup and Shutdown for Oracle WebLogic Server ■ Configure backups for embedded LDAP servers in Oracle WebLogic Server Administration Console Help If the embedded LDAP server file becomes corrupt or unusable, the Administration Server will generate a NumberFormatException and fail to start. This situation is rare but can occur if the disk becomes full and causes the embedded LDAP file to enter into an invalid state. To recover from an unusable embedded LDAP server file, complete the following steps: 1. Change to the following directory: domain_name serversadminServerdata 2. Rename the embedded LDAP server file, as in the following example: mv ldap ldap.old By renaming the file, and not deleting it completely, it remains available to you for analysis and potential data recovery. 3. Start the Administration Server. When the Administration Server starts, a new embedded LDAP server file is created. 4. Restore any data to the new embedded LDAP server that was added since the time the WebLogic domain was created. If you have configured a backup of the embedded LDAP server, you can restore the backed up data by importing it. For information, see Section 9.4, Exporting and Importing Information in the Embedded LDAP Server.