OSB - ALSB / WLST / Security / add entry with WLST in Access Control

Question

Hello,
I try to reproduce with WLST script the input from the consol to declare user on Access Control proxy (security).
sbconsol->$Proxy Service->Security->General Confiruration->Access Control->Transport Access Control->Add Conditions
* First implementation without success with the com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean : accessControlSecurity1()
* Second try with the service definition of the proxy service but cannot parse with Xpath accessControl Security2()
any idee ???
test case :
prerequisit
create an ALSB domain 10.3 (admin one with username='weblogic' password='weblogic' url='t3://localhost:7001') and create a proxy service on the default project
conf/setEnv.cmd
@CLS
@echo ON
@set BEA_HOME=D:\PRODUCT\MIDDLEWARE\SOA\OSB_10.3
@set WL_HOME=%BEA_HOME%\wlserver_10.3
@set OSB_HOME=%BEA_HOME%\osb_10.3
@set SCRIPTING_HOME=E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security
@set OSB_LIB=%OSB_HOME%/lib/sb-kernel-api.jar;%BEA_HOME%/modules/com.bea.alsb.statistics_1.0.1.0.jar;%OSB_HOME%/lib/sb-kernel-resources.jar;%OSB_HOME%/lib/sb-kernel-common.jar;%OSB_HOME%/lib/sb-kernel-impl.jar;%OSB_HOME%\lib\sb-security.jar;%OSB_HOME%/modules/com.bea.common.configfwk_1.3.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.1.0.jar;%OSB_HOME%/lib/modules/com.bea.alsb.resources.archive.jar;
@set TOOL_LIB=%SCRIPTING_HOME%\lib\log4j-1.2.15.jar;%SCRIPTING_HOME%\lib\jsch-0.1.43.jar;%SCRIPTING_HOME%\lib\db2jcc.jar
@set CLASSPATH=%OSB_LIB%;%TOOL_LIB%;%CLASSPATH%
@set CLASSPATH=%SCRIPTING_HOME%\lib\db2jcc.jar;%TOOL_LIB%;%CLASSPATH%
@set MODULE_LIB=%SCRIPTING_HOME%\lib
@call %WL_HOME%\server\bin\setWLSEnv.cmd > nul 2<&1
launch.cmd
@CLS
@echo OFF
@SETLOCAL
@call "conf\setEnv.cmd" > nul 2<&1
set PWD=%~dp0
%JAVA_HOME%\bin\java -Dmodule.lib=%MODULE_LIB% weblogic.WLST -skipWLSModuleScanning lib/security.py
lib/security.py
from com.bea.wli.monitoring import StatisticType
from java.util import HashMap
from java.util import HashSet
from java.util import ArrayList
from java.util import Collections
from java.io import FileInputStream
from java.io import FileOutputStream
from java.lang import String
from java.lang import Boolean
from com.bea.wli.sb.util import EnvValueTypes
from com.bea.wli.config.env import EnvValueQuery;
from com.bea.wli.config import Ref
from com.bea.wli.config.customization import Customization
from com.bea.wli.config.customization import EnvValueCustomization
from com.bea.wli.config.customization import FindAndReplaceCustomization
from com.bea.wli.sb.management.configuration import SessionManagementMBean
from com.bea.wli.sb.management.configuration import ALSBConfigurationMBean
from com.bea.wli.sb.management.query import BusinessServiceQuery
from com.bea.wli.sb.management.query import ProxyServiceQuery
from com.bea.wli.sb.management.configuration import ServiceConfigurationMBean
import os
# before, create an ALSB domain 10.3 with a proxy service in the default project and add an Acces Control Policy in the consol
# sbconsol->Project Explorer->default->${proxy service}->Security->Access Control->Create Session->Add Conditions->User->USR_1->Add
# when we try to modify the Acces Control Policy of the proxy service with the ServiceSecurityConfigurationMBean
def accessControlSecurity1( domain_name ):
          # connection
          print "\n\n\n***********************************************************************************************"
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get the ServiceSecurityConfigurationMBean
          serviceSecurityConfigurationMBean = findService(String("ServiceSecurityConfiguration.").concat(sessionName), "com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean")
          # get the XACMLAuthorizer
          working_directory=pwd()
          serverConfig()
          xacmlAuthorizer = cd('/SecurityConfiguration/%s/Realms/myrealm/Authorizers/XACMLAuthorizer' % domain_name )
          cd(working_directory)
          domainRuntime()
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref               
               # use the security Mbean to add : USER_A,USER_B,USER_C to the policy
               policyHolder = serviceSecurityConfigurationMBean.newAccessControlPolicyHolderInstance(xacmlAuthorizer)
               policyHolder.setPolicyExpression("Usr(USER_A,USER_B,USER_C)")     
               policyScope = serviceSecurityConfigurationMBean.newDefaultMessagePolicyScope(ref)
               serviceSecurityConfigurationMBean.setAccessControlPolicy(policyScope,policyHolder)
               # print the service definition
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               print serviceDefinition
               # we can see the security entry in the service definition has follow
               # <xml-fragment xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
               # <ser:coreEntry isProxy="true" isEnabled="true" isAutoPublish="false">
               # <ser:description/>
               # <ser:security>
               # <con:access-control-policies xmlns:con="http://www.bea.com/wli/sb/services/security/config">
               # <con:message-level-policies>
               # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config">
               # <con:policy provider-id="XACMLAuthorizer">
               # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
               # </con:policy>
               # </con1:default-policy>
               # </con:message-level-policies>
               # </con:access-control-policies>
               # </ser:security>
          # but when we commit
          SessionMBean.activateSession(sessionName, "description for session activation")
          # we got the following exception
          # Unexpected error: com.bea.wli.config.session.SessionConflictException
          # No stack trace available.
          # Problem invoking WLST - Traceback (innermost last):
          # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 246, in ?
          # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 105, in accessControlSecurity1
          # com.bea.wli.config.session.SessionConflictException: Conflicts for session SessionScript1363339726764
          # [Non-Critical] Concurrent Modification Conflicts
          # NONE
          # [Critical] Resources with validation errors
          # 1 - ProxyService test/PS_TEST_bis CannotCommit
          # + CannotCommit [OSB Security:386836]Unnecessary proxy wide message access control policy found for service "test/PS_TEST_bis". Hint: The service is neither an active security
          # intermediary nor has custom authentication enabled. ServiceDiagnosticLocation[SECURITY_TAB]:DiagnosticLocation:<con:message-level-policies xmlns:ser="http://www.bea.com/wli/sb/services" xml
          # ns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env" xmlns:con="http://www.bea.com/wli/sb/services/security/config">
          # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/
          # config">
          # <con:policy provider-id="XACMLAuthorizer">
          # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
          # </con:policy>
          # </con1:default-policy>
          # </con:message-level-policies>
          # [Info] Informational messages
          # NONE
          # at com.bea.wli.config.session.SessionManager.commitSessionUnlocked(SessionManager.java:358)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:339)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:297)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:306)
          disconnect()                              
# when we try to modify the Acces Control Policy of the proxy service whith the service XML definition
def accessControlSecurity2( domain_name ):
          # connection
          print "\n\n\n***********************************************************************************************"
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               # parsing the proxy definition
               nsSer = "declare namespace ser='http://www.bea.com/wli/sb/services'"
               nsXsi = "declare namespace xsi='http://www.w3.org/2001/XMLSchema-instance'"
               nsTran = "declare namespace tran='http://www.bea.com/wli/sb/transports'"
               nsEnv = "declare namespace env='http://www.bea.com/wli/config/env'"
               nsCon = "declare namespace con='http://www.bea.com/wli/sb/services/security/config'"
               nsCon1 = "declare namespace con1='http://www.bea.com/wli/sb/services/security/config'"
               # when we try to parse the following Xpath Expression, it' working but not sufficent to access the <con:policy-expression> element
               confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy"
               confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
               print "WORKING{%s}" % confElem
               # get the result
               # <xml-fragment xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config" xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
               # <con:policy provider-id="XACMLAuthorizer">
               # <con:policy-expression>Usr(USER_1,USER_2,USER_3)</con:policy-expression>
               # </con:policy>
               # </xml-fragment>
               # and when we try to acces the <con:policy> element whith the following Xpath expression we got an empty result
               confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy/con:policy"
               confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
               print "DON'T WORKING{%s}" % confElem
               # get empty result
               # array([], org.apache.xmlbeans.XmlObject)
          # want to modify the value like this on the <con:policy-expression> but cannot reach it ...
          #confValue="Usr(USER_A,USER_B,USER_C)"
          #confElem.setStringValue(confValue)
          # commit                
          SessionMBean.activateSession(sessionName, "description for session activation")
          disconnect
# print the service definition
def printServiceDefinition( domain_name ):
          # connection
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               print serviceDefinition
          # commit                
          SessionMBean.activateSession(sessionName, "description for session activation")
          disconnect
#accessControlSecurity1('cluster_domain')
accessControlSecurity2('cluster_domain')

Answer 1

Hello,
I try to reproduce with WLST script the input from the consol to declare user on Access Control proxy (security).
sbconsol->$Proxy Service->Security->General Confiruration->Access Control->Transport Access Control->Add Conditions
* First implementation without success with the com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean : accessControlSecurity1()
* Second try with the service definition of the proxy service but cannot parse with Xpath accessControl Security2()
any idee ???
test case :
prerequisit
create an ALSB domain 10.3 (admin one with username='weblogic' password='weblogic' url='t3://localhost:7001') and create a proxy service on the default project
conf/setEnv.cmd
@CLS
@echo ON
@set BEA_HOME=D:\PRODUCT\MIDDLEWARE\SOA\OSB_10.3
@set WL_HOME=%BEA_HOME%\wlserver_10.3
@set OSB_HOME=%BEA_HOME%\osb_10.3
@set SCRIPTING_HOME=E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security
@set OSB_LIB=%OSB_HOME%/lib/sb-kernel-api.jar;%BEA_HOME%/modules/com.bea.alsb.statistics_1.0.1.0.jar;%OSB_HOME%/lib/sb-kernel-resources.jar;%OSB_HOME%/lib/sb-kernel-common.jar;%OSB_HOME%/lib/sb-kernel-impl.jar;%OSB_HOME%\lib\sb-security.jar;%OSB_HOME%/modules/com.bea.common.configfwk_1.3.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.1.0.jar;%OSB_HOME%/lib/modules/com.bea.alsb.resources.archive.jar;
@set TOOL_LIB=%SCRIPTING_HOME%\lib\log4j-1.2.15.jar;%SCRIPTING_HOME%\lib\jsch-0.1.43.jar;%SCRIPTING_HOME%\lib\db2jcc.jar
@set CLASSPATH=%OSB_LIB%;%TOOL_LIB%;%CLASSPATH%
@set CLASSPATH=%SCRIPTING_HOME%\lib\db2jcc.jar;%TOOL_LIB%;%CLASSPATH%
@set MODULE_LIB=%SCRIPTING_HOME%\lib
@call %WL_HOME%\server\bin\setWLSEnv.cmd > nul 2<&1
launch.cmd
@CLS
@echo OFF
@SETLOCAL
@call "conf\setEnv.cmd" > nul 2<&1
set PWD=%~dp0
%JAVA_HOME%\bin\java -Dmodule.lib=%MODULE_LIB% weblogic.WLST -skipWLSModuleScanning lib/security.py
lib/security.py
from com.bea.wli.monitoring import StatisticType
from java.util import HashMap
from java.util import HashSet
from java.util import ArrayList
from java.util import Collections
from java.io import FileInputStream
from java.io import FileOutputStream
from java.lang import String
from java.lang import Boolean
from com.bea.wli.sb.util import EnvValueTypes
from com.bea.wli.config.env import EnvValueQuery;
from com.bea.wli.config import Ref
from com.bea.wli.config.customization import Customization
from com.bea.wli.config.customization import EnvValueCustomization
from com.bea.wli.config.customization import FindAndReplaceCustomization
from com.bea.wli.sb.management.configuration import SessionManagementMBean
from com.bea.wli.sb.management.configuration import ALSBConfigurationMBean
from com.bea.wli.sb.management.query import BusinessServiceQuery
from com.bea.wli.sb.management.query import ProxyServiceQuery
from com.bea.wli.sb.management.configuration import ServiceConfigurationMBean
import os
# before, create an ALSB domain 10.3 with a proxy service in the default project and add an Acces Control Policy in the consol
# sbconsol->Project Explorer->default->${proxy service}->Security->Access Control->Create Session->Add Conditions->User->USR_1->Add
# when we try to modify the Acces Control Policy of the proxy service with the ServiceSecurityConfigurationMBean
def accessControlSecurity1( domain_name ):
          # connection
          print "\n\n\n***********************************************************************************************"
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get the ServiceSecurityConfigurationMBean
          serviceSecurityConfigurationMBean = findService(String("ServiceSecurityConfiguration.").concat(sessionName), "com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean")
          # get the XACMLAuthorizer
          working_directory=pwd()
          serverConfig()
          xacmlAuthorizer = cd('/SecurityConfiguration/%s/Realms/myrealm/Authorizers/XACMLAuthorizer' % domain_name )
          cd(working_directory)
          domainRuntime()
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref               
               # use the security Mbean to add : USER_A,USER_B,USER_C to the policy
               policyHolder = serviceSecurityConfigurationMBean.newAccessControlPolicyHolderInstance(xacmlAuthorizer)
               policyHolder.setPolicyExpression("Usr(USER_A,USER_B,USER_C)")     
               policyScope = serviceSecurityConfigurationMBean.newDefaultMessagePolicyScope(ref)
               serviceSecurityConfigurationMBean.setAccessControlPolicy(policyScope,policyHolder)
               # print the service definition
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               print serviceDefinition
               # we can see the security entry in the service definition has follow
               # <xml-fragment xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
               # <ser:coreEntry isProxy="true" isEnabled="true" isAutoPublish="false">
               # <ser:description/>
               # <ser:security>
               # <con:access-control-policies xmlns:con="http://www.bea.com/wli/sb/services/security/config">
               # <con:message-level-policies>
               # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config">
               # <con:policy provider-id="XACMLAuthorizer">
               # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
               # </con:policy>
               # </con1:default-policy>
               # </con:message-level-policies>
               # </con:access-control-policies>
               # </ser:security>
          # but when we commit
          SessionMBean.activateSession(sessionName, "description for session activation")
          # we got the following exception
          # Unexpected error: com.bea.wli.config.session.SessionConflictException
          # No stack trace available.
          # Problem invoking WLST - Traceback (innermost last):
          # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 246, in ?
          # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 105, in accessControlSecurity1
          # com.bea.wli.config.session.SessionConflictException: Conflicts for session SessionScript1363339726764
          # [Non-Critical] Concurrent Modification Conflicts
          # NONE
          # [Critical] Resources with validation errors
          # 1 - ProxyService test/PS_TEST_bis CannotCommit
          # + CannotCommit [OSB Security:386836]Unnecessary proxy wide message access control policy found for service "test/PS_TEST_bis". Hint: The service is neither an active security
          # intermediary nor has custom authentication enabled. ServiceDiagnosticLocation[SECURITY_TAB]:DiagnosticLocation:<con:message-level-policies xmlns:ser="http://www.bea.com/wli/sb/services" xml
          # ns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env" xmlns:con="http://www.bea.com/wli/sb/services/security/config">
          # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/
          # config">
          # <con:policy provider-id="XACMLAuthorizer">
          # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
          # </con:policy>
          # </con1:default-policy>
          # </con:message-level-policies>
          # [Info] Informational messages
          # NONE
          # at com.bea.wli.config.session.SessionManager.commitSessionUnlocked(SessionManager.java:358)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:339)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:297)
          # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:306)
          disconnect()                              
# when we try to modify the Acces Control Policy of the proxy service whith the service XML definition
def accessControlSecurity2( domain_name ):
          # connection
          print "\n\n\n***********************************************************************************************"
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               # parsing the proxy definition
               nsSer = "declare namespace ser='http://www.bea.com/wli/sb/services'"
               nsXsi = "declare namespace xsi='http://www.w3.org/2001/XMLSchema-instance'"
               nsTran = "declare namespace tran='http://www.bea.com/wli/sb/transports'"
               nsEnv = "declare namespace env='http://www.bea.com/wli/config/env'"
               nsCon = "declare namespace con='http://www.bea.com/wli/sb/services/security/config'"
               nsCon1 = "declare namespace con1='http://www.bea.com/wli/sb/services/security/config'"
               # when we try to parse the following Xpath Expression, it' working but not sufficent to access the <con:policy-expression> element
               confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy"
               confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
               print "WORKING{%s}" % confElem
               # get the result
               # <xml-fragment xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config" xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
               # <con:policy provider-id="XACMLAuthorizer">
               # <con:policy-expression>Usr(USER_1,USER_2,USER_3)</con:policy-expression>
               # </con:policy>
               # </xml-fragment>
               # and when we try to acces the <con:policy> element whith the following Xpath expression we got an empty result
               confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy/con:policy"
               confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
               print "DON'T WORKING{%s}" % confElem
               # get empty result
               # array([], org.apache.xmlbeans.XmlObject)
          # want to modify the value like this on the <con:policy-expression> but cannot reach it ...
          #confValue="Usr(USER_A,USER_B,USER_C)"
          #confElem.setStringValue(confValue)
          # commit                
          SessionMBean.activateSession(sessionName, "description for session activation")
          disconnect
# print the service definition
def printServiceDefinition( domain_name ):
          # connection
          connect( 'weblogic', 'weblogic', 't3://localhost:7001')
          domainRuntime()
          # create a session
          sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
          SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
          SessionMBean.createSession(sessionName)
          # get service ref
          ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
          bsQuery = ProxyServiceQuery()
          bsQuery.setPath("default/*")
          refs = ConfigurationMBean.getRefs(bsQuery)
          for ref in refs:
               print 'ref=%s'%ref
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
               serviceDefinition = servConfMBean.getServiceDefinition(ref)
               print serviceDefinition
          # commit                
          SessionMBean.activateSession(sessionName, "description for session activation")
          disconnect
#accessControlSecurity1('cluster_domain')
accessControlSecurity2('cluster_domain')