Weblogic Security Queries

Question

Hi All,
My requirements are as follows:
1) Have a central repository like the iplanet Directory server to store the information
of users,groups etc
2)Perform identity management to manage roles and permissions This includes the
ability to define users, resources, and abstract concepts such as a user role
or a group
3)The final requirement is access management. This is the enforcement of which
users have access to what information. It includes authentication and authorization
mechanisms to make sure someone is who they claim to be and that they have the
authority to get the information they requested, and access management to enforce
the permissions
I need to achieve these requirements for my Portal application. My queries for
the same are as follows
1)The default Weblogic authetication providers can be used to authenticate users
located on iplanet Directory server.
2)But my doubt is with the authorization provider, Role Mapper providers etc they
seem to be tightly coupled to the embedded LDAP. In order to solve my requirements
on 2 and 3 what are the approaches that are available.
3)I also have tried to create a new Realm that the Iplanet authentication provider
configured to authenticate against iPlanet LDAP and also the other default providers
that come along with
weblogic to do authorization checks. When I try to start my server I get the following
errror and the server does not start.
<Nov 28, 2003 4:58:31 PM GMT+05:30> <Critical> <Security> <BEA-090404> <User weblogic
is not permitted to boot the server; The
server policy may have changed in such a way that the user is no longer able to
boot the server.Reboot the server with the administrative user account or contact
the system administrator to update the server policy definitions.>
The WebLogic Server did not start up properly.
Reason: weblogic.security.SecurityInitializationException: User weblogic is not
permitted to boot the server; The server policy
may have changed in such a way that the user is no longer able to boot the server.Reboot
the server with the administrative us
er account or contact the system administrator to update the server policy definitions.
Can anyone suggest me any ways to solve my queries and if you could provide some
input on how to solve my requirements that will be very useful and we are WLS
shop so the solution should be within the reach of weblogic server security

Answer 1

Hi,
This is w.r.t the same query.
1)Where do you want your role and policy information stored? How is your role
and policy information defined? The WLS framework is limited to WLS resources
(ejbs,
webapps,jdbc connection pools, etc.)
Ans) The Roles and Policies are defined in the External LDAP.
"Anand" <[email protected]> wrote:
>
Hi,
Thanks for your replies. I have a couple of other queries which are as
follows:
1. How do we decouple the Embeded LDAP and connect to External LDAP Server
for
Authentication and Authorization( I prefer iPlanet LDAP Server)
2. Is Portal WLS resource ? If so I want to build a Access Control List.
3. Can you point me to any resource which guides me how to configure
iPlanet server
for authentication and Authorization. I am a novice. This tutorial/sample
should
include all necessary codes.
"Peter" <PeterB> wrote:
"Anand" <[email protected]> wrote in message
news:[email protected]...
Hi All,
My requirements are as follows:
1) Have a central repository like the iplanet Directory server to
store
the information
of users,groups etc
2)Perform identity management to manage roles and permissions Thisincludes the
ability to define users, resources, and abstract concepts such as
a
user
role
or a group
3)The final requirement is access management. This is the enforcementof
which
users have access to what information. It includes authentication
and
authorization
mechanisms to make sure someone is who they claim to be and that theyhave
the
authority to get the information they requested, and access managementto
enforce
the permissions
I need to achieve these requirements for my Portal application. Myqueries
for
the same are as follows
1)The default Weblogic authetication providers can be used to authenticateusers
located on iplanet Directory server.
2)But my doubt is with the authorization provider, Role Mapper providersetc they
seem to be tightly coupled to the embedded LDAP. In order to solvemy
requirements
on 2 and 3 what are the approaches that are available.The role mapper and authorization providers do store roles and policies
in
embedded
ldap server.
Where do you want your role and policy information stored? How is your
role
and policy
information defined? The WLS framework is limited to WLS resources (ejbs,
webapps,
jdbc connection pools, etc.)
3)I also have tried to create a new Realm that the Iplanet authenticationprovider
configured to authenticate against iPlanet LDAP and also the otherdefault providers
that come along with
weblogic to do authorization checks. When I try to start my serverI get
the following
errror and the server does not start.
WLS uses the server resource to determine if you can boot the server.
There
is a policy
that allows users with admin or operator role. The default for thatrole
is
member
of the administrators or operators group. You can change this role
expression with
the console.
Therefore, check to see if your boot user is a member of the administrators
group.
>