Defining security-constraint for weblogic

Question

          I'm working on declarative security using web.xml. Somehow I need to define the
          user names, password, etc. in which j_security_check relies on. I created a JAAS
          LoginModule which connects to me database and looks up users.
          How do I tell weblogic what to use when authenticating users? I'd imagine it's
          some weblogic.xml element, but I can't figure it out.
          thanks
          James
          

Answer 1

          James,
          If you use JAAS callback to go to your databse and authenticate a user say "A",
          this doesn't help becaase Weblogic has no idea who A is or what groups A belongs
          to.
          Once you use a realm, WLS knows exactly who A is and which groups he belongs to,
          then the declartive security in web.xml comes into play. For example if you restrict
          certain resources to a principal named "Administrators" and then map it to a group
          named "Administrators" in the realm. Once A is made a member of this group, he
          will be able to access the protected resources automatically.
          "James Leone" <[email protected]> wrote:
          >
          >I've read up on Realms and looked at the example for implementing a custom
          >realm.
          >
          >Are you telling me that all of that security stuff in web.xml not implemented
          >through JAAS, rather I need to implement the weblogic interfaces to create
          >my
          >own realm?
          >
          >If this is the case, what good is JAAS in a web application (more specifically
          >LoginModule and Callbacks)? It would make sense if weblogic itself implemented
          >the framework in JAAS, the I point it to my custom LoginModule (this
          >opposed to
          >implementing a proprietary realm).
          >
          >"Jawahar" <[email protected]> wrote:
          >>
          >>James,
          >>
          >>You should be using a security realm and not reading the database yourself.
          >>Read
          >>up on realms and set one up.
          >