How to Lockup unauthorized JNDI Lookups

Question

Hello,
I am running JNDI datasource from my Weblogic Server. I wrote an unauthorized
client that makes a lookup on the JNDI "someJNDIName" and the program basically
gets data from a table. See below....
How do I lockup unauthorized clients? I want only the JSP pages to do the JNDI
lookup and do the processing.
Is there any setting I have to do, so that only authorized clients can access
the JNDI?.
Thanks.
---------------------------------------------- import java.sql.*; import java.util.*;
import javax.naming.*;
public class TestPool
{ public static void main(String [] args) { Context ctx = null; Hashtable ht =
new Hashtable(); ht.put(Context.INITIAL_CONTEXT_FACTORY,"weblogic.jndi.WLInitialContextFactory");
ht.put(Context.PROVIDER_URL,"t3://localhost:7001");
Connection conn = null; Statement stmt = null; ResultSet rs = null;
try { ctx = new InitialContext(ht); javax.sql.DataSource ds = (javax.sql.DataSource)
ctx.lookup ("someJNDIName");
conn = ds.getConnection(); // You can now use the conn object to create // Statements
and retrieve result sets: stmt = conn.createStatement(); stmt.execute("select
* from USERS"); rs = stmt.getResultSet(); if(rs == null) System.out.println("Result
Set is null"); while(rs.next()) System.out.println(rs.getString(2)); } catch (Exception
e) { System.out.println("Exception caught: "+e.getMessage()); } finally { try
{ ctx.close(); } catch (Exception e) { System.out.println("Cannot close the context");
try { if (rs != null) rs.close(); } catch (Exception e) { System.out.println("Cannot
close the result set"); } try { if (stmt != null) stmt.close(); } catch (Exception
e) { System.out.println("Cannot close the Statement"); } try { if (conn != null)
conn.close(); } catch (Exception e) { System.out.println("Cannot close the Connection");
[TestPool.java]

Answer 1

Hi,
Take a look at the following:
http://e-docs.bea.com/wls/docs70/secwlres/secroles.html#1208744
That is for WLS 8.1. Other versions' docs will have a similar link. Also make
sure that you disable user guest. This is done as the default in WLS 7.0 and
higher. Prior to 7.0 you disable guest user through the console.
Hope this helps,
pat
"John Mathunny" <[email protected]> wrote:
>
>
>
Hello,
I am running JNDI datasource from my Weblogic Server. I wrote an unauthorized
client that makes a lookup on the JNDI "someJNDIName" and the program
basically
gets data from a table. See below....
How do I lockup unauthorized clients? I want only the JSP pages to do
the JNDI
lookup and do the processing.
Is there any setting I have to do, so that only authorized clients can
access
the JNDI?.
Thanks.
---------------------------------------------- import java.sql.*; import
java.util.*;
import javax.naming.*;
public class TestPool
{ public static void main(String [] args) { Context ctx = null; Hashtable
ht =
new Hashtable(); ht.put(Context.INITIAL_CONTEXT_FACTORY,"weblogic.jndi.WLInitialContextFactory");
ht.put(Context.PROVIDER_URL,"t3://localhost:7001");
Connection conn = null; Statement stmt = null; ResultSet rs = null;
try { ctx = new InitialContext(ht); javax.sql.DataSource ds = (javax.sql.DataSource)
ctx.lookup ("someJNDIName");
conn = ds.getConnection(); // You can now use the conn object to create
// Statements
and retrieve result sets: stmt = conn.createStatement(); stmt.execute("select
* from USERS"); rs = stmt.getResultSet(); if(rs == null) System.out.println("Result
Set is null"); while(rs.next()) System.out.println(rs.getString(2));
} catch (Exception
e) { System.out.println("Exception caught: "+e.getMessage()); } finally
{ try
{ ctx.close(); } catch (Exception e) { System.out.println("Cannot close
the context");
try { if (rs != null) rs.close(); } catch (Exception e) { System.out.println("Cannot
close the result set"); } try { if (stmt != null) stmt.close(); } catch
(Exception
e) { System.out.println("Cannot close the Statement"); } try { if (conn
!= null)
conn.close(); } catch (Exception e) { System.out.println("Cannot close
the Connection");