WebLogic Security Service Architecture 5-5
requested action on the WebLogic resource, that is, the Authorization provider makes the Access Decision. If there are multiple Authorization providers configured, the
WebLogic Security Framework delegates the job of reconciling any conflicts in the Access Decisions rendered by the Authorization providers to the Adjudication
provider and the Adjudication provider determines the ultimate outcome of the authorization decision.
5.1.5 The Adjudication Process
If there are multiple Authorization providers configured see Figure 5–5
, an Adjudication provider is required to tally the multiple Access Decisions and render a
verdict. The Adjudication provider returns either a TRUE or FALSE verdict to the Authorization providers, which forward it to the resource container through the
WebLogic Security Framework.
■
If the decision is TRUE, the resource container dispatches the request to the protected WebLogic resource.
■
If the decision is FALSE, the resource container throws a security exception that indicates that the requestor was not authorized to perform the requested access on
the protected WebLogic resource.
5.1.6 The Role Mapping Process
The WebLogic Security Framework calls each Role Mapping provider that is configured for a security realm as part of an authorization decision. For related
information, see Section 5.1.4, The Authorization Process
. Figure 5–6
shows how the Role Mapping providers interact with the WebLogic Security Framework to create dynamic role associations.
Figure 5–6 Role Mapping Process
The role mapping process is initiated when a user or system process requests a WebLogic resource on which it will attempt to perform a given operation. The resource
container that handles the type of WebLogic resource being requested receives the request for example, the EJB container receives the request for an EJB resource. The
resource container calls the WebLogic Security Framework and passes in the request parameters, including information such as the subject of the request and the WebLogic
resource being requested. The WebLogic Security Framework calls each configured Role Mapping provider to obtain a list of the roles that apply. If a security policy
specifies that the requestor is entitled to a particular role, the role is added to the list of roles that are applicable to the subject. This process continues until all security policies
that apply to the WebLogic resource or the resource container have been evaluated. The list of roles is returned to the WebLogic Security Framework, where it can be used
as part of other operations, such as access decisions.
5-6 Understanding Security for Oracle WebLogic Server
The result of the dynamic role association performed by the Role Mapping providers is a set of roles that apply to the principals stored in a subject at a given moment.
These roles can then be used to make authorization decisions for protected WebLogic resources, as well as for resource container and application code. For example, an
Enterprise JavaBean EJB could use the Java EE isCallerInRole method to retrieve fields from a record in a database, without having knowledge of the business policies
that determine whether access is allowed.
5.1.7 The Auditing Process
