Read this to find out how to add/update/delete users and change/reset passwords programmatically

Question

WebLogic 7.0
I have read a number of questions on how to do these but not many answers, so
after figuring it all out, I thought I would post a message describing all these
tasts (It would be great if BEA would start something like 'HOW-TOs for Linux'
for WebLogic)
-1. Imports required :
import weblogic.jndi.Environment;
import weblogic.management.MBeanHome;
import weblogic.management.WebLogicObjectName;
import weblogic.management.configuration.DomainMBean;
import weblogic.management.configuration.SecurityConfigurationMBean;
import weblogic.management.security.RealmMBean;
import weblogic.management.security.authentication.AuthenticationProviderMBean;
import weblogic.management.security.authentication.GroupEditorMBean;
import weblogic.management.security.authentication.UserEditorMBean;
import weblogic.management.security.authentication.UserPasswordEditorMBean;
import weblogic.security.providers.authentication.*;
0. Code to retrieve DefaultAuthenticatorMBean (this code is running inside WebLogic
server - I have it inside EJB):
DefaultAuthenticatorMBean authBean;
Context ctx = new InitialContext();
MBeanHome mbeanHome = (MBeanHome) ctx.lookup(MBeanHome.ADMIN_JNDI_NAME);
//Find UserEditorMBean
DomainMBean dmb = mbeanHome.getActiveDomain();
SecurityConfigurationMBean scmb = dmb.getSecurityConfiguration();
RealmMBean rmb = scmb.findDefaultRealm();
AuthenticationProviderMBean[] providers = rmb.getAuthenticationProviders();
for (int i = 0; i < providers.length; i++) {
if (providers[i] instanceof DefaultAuthenticatorMBean) {    
authBean = (DefaultAuthenticatorMBean) providers;
break;
1. Create/Drop/Update users
to perform these tasks, the user must be logged in into weblogic and be in Administrators
group. Then, the code is as follows:
create user: authBean.createUser(username, password, description);
remove user: authBean.removeUser(username);
change user's description: authBean.setUserDescription(username, newDescription);
remove user from group: authBean.removeMemberFromGroup(groupname, username);
add user to group: authBean.addMemberToGroup(groupname, username);
2. Change other users' passwords (MUST BE ADMIN TO DO THIS - by Admin I mean be
a member of Administrators group)
authBean.resetUserPassword(username, newPassword);
3. Change your own password:
this is a bit trickier, because if you are not an admin, you can't change your
own password!!!! This is a part that I personally don't understand - seems like
a screw up on BEA's part. So, to allow users to change their own passwords, you
must change security context in the middle of processing to that of Admin user
and run this function as Admin user. Although a bit ackward, it's very easy to
do. Suppose you have two EJBs - EJB A and EJB B. EJB A does normal processing
for the user and always runs in logged in user's security context. Now, suppose
you want to add a method to EJB A to change current password. The method may
look like:
public void changePassword(String logon, String oldpwd, String newpwd)
throws some exceptions
Now, there is no way to do it in EJB A, because for most users, it will run in
a 'non-admin' security context. So, to get around it, you create another
EJB - EJB B. This EJB has one method:
public void changePassword(String logon, String oldpwd, String newpwd)
throws some exceptions
and one major difference - this EJB always runs in a secrity context of admin
user. To get an EJB B running 'as admin user', all you have to do in EJB A is
the following
EJB A:
public void changePassword(String logon, String oldpwd, String newpwd)
Hashtable props = new Hashtable();
props.put(Context.SECURITY_PRINCIPAL, "wlmanager");
props.put(Context.SECURITY_CREDENTIALS, "password");
// get context that with different credentials
Context ctx = new InitialContext(props);
EJBBHome home = (EJBBHome) ctx.lookup("EJBBHome");
EJBBLocal adminEJB = home.create();
adminEJB.changePassword(logon, oldpwd, newpwd);
adminEJB.remove();
of course, this poses a problem of hardcoding user id and password for admin user
in your application - you can come up with your own ways to secure that.
THAT's IT!!! You can use the method explained in part 3 to allow non-admin users
to do pretty much everything, however for the sake of security, I would definetly
vote against it and use part 3 to ONLY allow users change their own passwords
Enjoy
Andrey

Answer 1

I have a similar question, I would like to edit the artwork for EACH episode in the podcast, as well as have one artwork for the entire podcast series. Any suggestions? This is a podcast that I've created -- I did the same thing for a TV Show where I was able to do custom artwork for each episode, but not one single artwork for the entire series. Does anyone have suggestions of how i should proceed?
Recap:
One image for entire Podcast Series (or TV show)
Different Set of Images for each episode in Podcast. (Understand how to do this in TV show)
Thanks!