Declarative Security on Webservice Methods

Question

Hello,
I'm new to Weblogic 8.1 server so this may be a stupid questiion. Throughout the
docs it says that a security policy can be applied to methods of a web service
to control who can call it. I've tried over and over to make this work and it
seems that the default websevice security policy of allowing everyone access is
broken. I've defined users and put them into groups and then used the admin console
to create security policies that should only allow members of my admin group to
call all webservice methods and another group users to call only a subset of methods.
I have seen various problem scenarios.
1. A user that is not in either the admin or users groups can call all of the
methods without issue. The systems know about the user however because if I misspell
the user's password, the system complains.
2. A member of the users group has access to all of the methods. It seems like
if the security policy allows members of a group to call any of the methods, they
can call all of the methods.
Because I couldn't get this to work I instead tried to apply security policy
to the methods of the stateless session bean that implements the webservice. In
this respect I was much more successful. Scenario 2 above went away and I could
control who can call each method. Unfortunately, scenerio 1 still exists. A user
that is not assigned any group membership can still access all of the methods.
Anyone have an idea of what I am doing wrong or if this is a known issue with
WL8.1?
TIA,
Craig Lindley

Answer 1

Hi Craig,
The questions are never stupid; sometimes the answers are however :-)
This is a complex question and it is important to note that our web
services are deployed as standard J2EE components, you secure them by
using standard J2EE security procedures [1]. Since you are using access
control security, be sure to review this section of the doc [2] and I
would suggest that you also open a dialog with our great support team
(http://support.bea.com or [email protected]) because it sounds like you
are very close to to getting the right "magic" (roles, privs, policies,
etc.) configured. Note there is also a security newsgroup [3] that may
be of value.
Hope this helps,
Bruce
[1]
http://edocs.bea.com/wls/docs81/security/thin_client.html#1043568
[2]
http://edocs.bea.com/wls/docs81/webserv/security.html#1073530
[3]
http://newsgroups.bea.com/cgi-bin/dnewsweb?cmd=xover&group=weblogic.developer.interest.security
craig lindley wrote:
>
Hello,
I'm new to Weblogic 8.1 server so this may be a stupid questiion. Throughout the
docs it says that a security policy can be applied to methods of a web service
to control who can call it. I've tried over and over to make this work and it
seems that the default websevice security policy of allowing everyone access is
broken. I've defined users and put them into groups and then used the admin console
to create security policies that should only allow members of my admin group to
call all webservice methods and another group users to call only a subset of methods.
I have seen various problem scenarios.
1. A user that is not in either the admin or users groups can call all of the
methods without issue. The systems know about the user however because if I misspell
the user's password, the system complains.
2. A member of the users group has access to all of the methods. It seems like
if the security policy allows members of a group to call any of the methods, they
can call all of the methods.
Because I couldn't get this to work I instead tried to apply security policy
to the methods of the stateless session bean that implements the webservice. In
this respect I was much more successful. Scenario 2 above went away and I could
control who can call each method. Unfortunately, scenerio 1 still exists. A user
that is not assigned any group membership can still access all of the methods.
Anyone have an idea of what I am doing wrong or if this is a known issue with
WL8.1?
TIA,
Craig Lindley