NT realm works, but appears slow and unconfigurable

Question

Using WLS 6.1sp1 I successfully have authentication working
using the NT realm.
The most simplistic cases work but I'm having trouble with the
more complex cases. BEA does not provide examples on these:
#1. Listing Users/Groups from the console is extrememly SLOW.
Similar to Frank Febbraro's post (5-2-2001), whenever I
click on Security->Users from the console it takes 15-20
minutes to respond. Likewise, the Security-Groups option
never returns (Frank mentions it takes 30 minutes??)
#2. You can specify roles and principles, but not domains.
In the weblogic.xml descriptor I can specify principles or
roles using the <security-role-assignment>. But what I'd
like to do is not limit access to a proper NT group or
weblogic role, but rather an NT domain. That way any user
in the domain that is authenticated can access the resource.
I've heard other developers want this functionality as well.
#3. One domain works, multiple domains do not.
According to the "Managing Security Document"
(http://e-docs.bea.com/wls/docs61/adminguide/cnfgsec.html#1052721)
you can run the weblogic server on various machines,
including a "mutually trusted domain". What is not
stated is how to authenticate using those trusted domains.
For example, logging into the web brower using HTTP
challenge/response may work for the following username:
myusername
But this will not:
mydomain/myusername
nor this:
mytrusteddomain/myusername
And from within the console the Security->Filerealm tab
only allows selection of one realm, not multiple.
Anyone know of any further reading/examples for the NT realm?
Jason

Answer 1

>
Hi Jason,
I'll just dive right in here.
>
#1. Listing Users/Groups from the console is extrememly SLOW.
Similar to Frank Febbraro's post (5-2-2001), whenever I
click on Security->Users from the console it takes 15-20
minutes to respond. Likewise, the Security-Groups option
never returns (Frank mentions it takes 30 minutes??)
Yes. This has been a problem for a lot of users with NTRealms. The speed
issue has something to do with the way the console loads users and
groups. BEA is looking into the issue of why it is a problem for the
console to enumerate through group and user membership.
It is fairly fast, however, when the cachingRealm is simply cleared,
because different calls are being made internally.
So although this is definitely a performance issue with the console, you
should find that there are not performance problems for the "normal"
functioning of your realm -- authentication lookups and the clearning of
the CachingRealm should be reasonably fast.
>
#2. You can specify roles and principles, but not domains.
In the weblogic.xml descriptor I can specify principles or
roles using the <security-role-assignment>. But what I'd
like to do is not limit access to a proper NT group or
weblogic role, but rather an NT domain. That way any user
in the domain that is authenticated can access the resource.
I've heard other developers want this functionality as well.
Right. It is not possible to restrict access to a certain NT domain right
now.
>
#3. One domain works, multiple domains do not.
According to the "Managing Security Document"
(http://e-docs.bea.com/wls/docs61/adminguide/cnfgsec.html#1052721)
you can run the weblogic server on various machines,
including a "mutually trusted domain". What is not
stated is how to authenticate using those trusted domains.
For example, logging into the web brower using HTTP
challenge/response may work for the following username:
myusername
But this will not:
mydomain/myusername
nor this:
mytrusteddomain/myusername
Again, this is unfortunately expected behavior.
If you have 2 NT machines with a trust relationship, and you are using
these machines as the user/group store for WebLogic, there is no easy way
to get WebLogic to differentiate between a user/group on machine#1, versus
a user/group on machine#2. Weblogic views all users and groups,
regardless of where they are found, exactly the same -- exactly equally.
That is why you notice that specifying /mydomain/username or
mytrusteddomain/username both do not work.
>
And from within the console the Security->Filerealm tab
only allows selection of one realm, not multiple.
Right again. (Man, I seem to just be piling on the bad news right now.)
You can only have one "alternate" realm hooked into WebLogic at a time
currently.
I hope this helps answer your questions, even if most of the information
isn't exactly what you wanted to hear...
Cheers,
Joe Jerry