Configuring a Cross-Domain User Configure a Credential Mapping for Cross-Domain Security

Configuring Security for a WebLogic Domain 13-3

3. Check Cross Domain Security Enabled.

If you maintain any WebLogic domains that have not enabled cross-domain security, you need to add their domain names to the list of excluded domains, in the SecurityConfigurationMBean.ExcludedDomainNames attributes. To do this in the WebLogic Server Administration Console: 1. Click the name of the domain in the Domain Configuration section of the Home page.

2. Select Security General.

3. In the Excluded Domain Names field, enter the names of any domains that do not

have cross-domain security enabled. Enter the names of these domains separated either by semicolons or line breaks.

13.2.1.2 Configuring a Cross-Domain User

Cross-domain security in WebLogic Server uses a global security role named CrossDomainConnector with resource type remote and a group named CrossDomainConnectors, which is assigned the CrossDomainConnector role. Invocation requests from remote domains are expected to be from users with the CrossDomainConnector role. By default, the CrossDomainConnectors group has no users as members. You need to create one or more users and add them to the group CrossDomainConnectors. Typically, such a user will be a virtual system user and preferably should have no privileges other than those granted by the CrossDomainConnector security role.

13.2.1.3 Configure a Credential Mapping for Cross-Domain Security

In each WebLogic domain, you need to specify a credential to be used by each user on each remote domain that needs to be trusted. Do this by configuring credential mappings for each domain in the connection. Each credential mapping needs to specify: ■ The resource protocol, which is named cross-domain-protocol ■ The name of the remote domain that needs to interact with the local domain ■ The name of the user in the remote domain that will be authorized to interact with the local domain ■ The password of the user in the remote domain that will be authorized to interact with the local domain To configure a cross-domain security credential mapping in the WebLogic Server Administration Console, click Security Realms in the left panel. 1. Click the name of your security realm default is myrealm.

2. Select Credential Mappings Default, and click New.

3. On the Creating the Remote Resource for the Security Credential Mapping page: ■ Select Use cross-domain protocol. Note: The Credential Mapper identifies domains by their names. Therefore, it is important that the domains involved have unique names. 13-4 Securing Oracle WebLogic Server ■ In the Remote Domain field, enter the name of the remote domain that needs to interact with the local domain.

4. Click Next.

5. On the Create a New Security Credential Map Entry page, enter the following: ■ Local User : cross-domain ■ Remote User : User configured in the Remote Domain that is authorized to interact with the Local Domain. ■ Password : The password for the Remote User.

6. Click Finish.

See Create a Cross-Domain Security Credential Mapping in the Oracle WebLogic Server Administration Console Help.

13.2.2 Enabling Global Trust