Simplest way to restrict access to remote EJB calls

Question

I'm using weblogic 10.3 and I'm new to security in weblogic. I was looking at the documentation at http://docs.oracle.com/cd/E13222_01/wls/docs103/ConsoleHelp/taskhelp/security/ManageSecurityForDD.html
but got a little overwhelmed by the many options on how to implement security. Plus, I am getting confused between JDNI security and EJB Layer security (they're not the same thing, right?)
Can someone explain what the simplest way would be to prevent an "unauthorized" client to make remote EJB calls? For example, I know of the ConnectionFilters that you can implement, which can prevent remote callers from making T3 or IIOP calls if they're not from an authorized IP, etc. This is a good start but ideally I would want to password protect the EJBs, and any EJB client would have to provide this username/password somehow. Or possibly use two-way SSL for t3? The client app would have to provide a certificate to prove that it's trusted.
To be clear, I don't think I need weblogic to handle any fine-grained access control. I just want to make sure that the client (e.g., a webapp) is a trusted one. Once the EJB container is satisfied that the client is trusted (preferably by user/pass) then the client is free to execute any EJB methods.
Thanks in advance.
Edited by: user10123426 on Mar 14, 2012 10:26 AM

Answer 1

I'm don't think you can do a posture check by MAC address.  If you're using SSLVPN, and you're running Windows,  you can do a Host Scan check for the following registry key:
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Domain
Then set up a Pre-Login policy that goes Windows->Registry Check->Success->RegCheckOK
                                                                                                     |->Fail->RegCheckFail
At this point you've just verified that you can read that key and the value is stored for later use.  You're not making an allow/deny decision yet. 
Then in your Dynamic Access policy you do a Policy check for Location=RegCheckFail, that says "Unable to read registry".  The following DAP policy check looks for Location=RegCheckOK, and validates that the value is your AD domain. 
Alternatively, you could put a NAC box (ISE or Clean Access) 'behind/after' the VPN box, so although anyone can connect only domain machines (and/or whatever other posture checks you want to make, e.g. Antivirus status) make it through to the rest of the network.