JBoss to WebLogic Migration (Security)

Question

I'm completely new to WebLogic (and really AS administration in general) and am attempting to migrate a JBoss application over to WLS 10.3. I'm to the point where I'm successfully deploying the application, which is an ear containing a war and ejb jar. "Successfully deploying" translates to setting up the required datasources, adding the required descriptors to the ejb (weblogic-cmp-rdbms-jar.xml and weblogic-ejb-jar.xml), installing it without errors via the admin console, and successfully hitting the URL and pulling up a login prompt.
I've been studying the WebLogic security configuration and am getting a bit lost in all of the users, roles, policies, groups, authentication providers, authorization providers, adjudication providers, etc. In JBoss, we were using a DBMS based authentication scheme. This was done by simply adding the following to login-config.xml
<application-policy name = "myauth">
  <authentication>
     <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule" flag = "required">
          <module-option name = "dsJndiName">java:SomeDS</module-option>
          <module-option name = "unauthenticatedIdentity">guest</module-option>
          <module-option name = "principalsQuery">select userpassword, user_id from usertable where userlogin=?</module-option>
          <module-option name = "rolesQuery">select rolename, 'Roles' from userrolestable where userlogin=?</module-option>
     </login-module>
  </authentication>
</application-policy>and a security-domain tag in the jboss-web.xml descriptor. On the WebLogic side, I've added the following to config.xml:
<sec:authentication-provider xsi:type="wls:read-only-sql-authenticatorType">
     <sec:name>ROSQLAuth</sec:name>
     <sec:control-flag>SUFFICIENT</sec:control-flag>
     <wls:enable-group-membership-lookup-hierarchy-caching>false</wls:enable-group-membership-lookup-hierarchy-caching>
     <wls:data-source-name>SomeDS</wls:data-source-name>
     <wls:plaintext-passwords-enabled>true</wls:plaintext-passwords-enabled>
     <wls:descriptions-supported>false</wls:descriptions-supported>
     <wls:sql-get-users-password>select userpassword from usertable where userlogin=?</wls:sql-get-users-password>
     <wls:sql-user-exists>select userlogin from usertable where userlogin=?</wls:sql-user-exists>
     <wls:sql-list-member-groups>select rolename from userrolestable where userlogin = ?</wls:sql-list-member-groups>
     <wls:sql-list-users>select userlogin from usertable where userlogin like ?</wls:sql-list-users>
     <wls:sql-get-user-description>select description from usertable where userlogin = ?</wls:sql-get-user-description>
     <wls:sql-list-groups>select rolename from usertable where rolename like ?</wls:sql-list-groups>
     <wls:sql-group-exists>select rolename from userrolestable where rolename = ?</wls:sql-group-exists>
     <wls:sql-is-member>select userlogin from userrolestable where rolename = ? and userlogin = ?</wls:sql-is-member>
     <wls:sql-get-group-description>select rolename from userrolestable where userlogin = ?</wls:sql-get-group-description>
</sec:authentication-provider>Which seems to be partially effective in that I can see the correct users under the "Users and Groups" tab in the security realm. However, obviously my app isn't referencing this because I haven't told it to.
So - on to my question - what do I need to do to have my application reference this security configuration? I'm assuming I'm missing something in the descriptors, and potentially some association between the various "providers". Any help would be great, even if you can just point me to the correct subset of the security documentation.
Thanks!
Mike

Answer 1

You'll have to forgive me as I'm a bit out of my normal realm here, but if the security model is in place and working on JBoss and OC4J, shouldn't it work without any additional code in WL?
I was under the impression it was all standard J2EE JAAS and just required some finagling of the descriptors. For instance, in addition to the weblogic-cmp-rdbms-jar.xml and weblogic-ejb-jar.xml descriptors I added to the EJB, it looks like I'll also have to add weblogic.xml and weblogic-application.xml to my web app.
What I get confused on, though, is how to manage the roles and groups between my app, the read only sql auth/database, and the servers role/group configuration.
Thanks!
Mike
Edited by: mwc on Dec 24, 2008 7:16 AM