URGENT: external LDAP configuration from WLS 6.1

Hi,
I am trying to configure the LDAP Realm(Netscape directory server) for Weblogic
Server6.1. For any user to perform a bind
on my Directory Server it needs CN + serial number. But the Users actually don't
know all this and they use LoginID (which is unique in LDAP) in Login Screens.
How do I configure the
BEA server or how do I achieve this (please listout the steps).
DO I need to write a custom realm?
Thanks in Advance,
Srinivas

Similar Messages

External LDAP - Configuring the External LDAP to the Weblogic Server 10.3.3

I m new to LDAP concepts. Is there any documentation link to configure any of the External LDAP for WLS 10.3.3?
Where can I download to install the Extarnal LDAP?
Thanks

To use Active Directory for quick testing with Weblogic, you can use either Suns Sun One Active Directory Server or OpenLDAP which is an open source LDAP. We use OpenLDAP on unix and configure this with WLS. All our users are in OpenLDAP. Try googling around like "OpenLDAP Download" or "Sun One Directory Server" etc. All these are LDAP sources with very minor differences (Some extra attributes here and there). Configuration wise all are same from WLS point of view. We define LDAPs Host, Port, admin useranme/password, User basedn and Group basedn. These are minimum things we need to know upfront.
Thanks
Ravi Jegga

Excessive LDAP Queries from WLS 6.0 SP2 RP3

We have an application served from WLS 6.0. Our current version of WLS is:
Service Pack 2 05/24/2001 11:55:28 #117037 RP3 for 6.0 SP2 02/21/2002 17:46:45
#167070
WLS has been configured to query an LDAP server for user authentication. The issue
we are experiencing is that WLS performs the LDAP query on EVERY page load in
the application. This is resulting in excessive calls to the LDAP server, and
increased response times.
We have attempted to change the caching realm settings such that the cache is
refreshed every 15 minutes as follows:
<CachingRealm AuthenticationCacheSize="601"
AuthenticationCacheTTLPositive="900" BasicRealm="X_LDAP"
CacheCaseSensitive="true" GroupMembershipCacheTTL="900"
Name="X_CACHE" UserCacheSize="601" UserCacheTTLPositive="900"/>
This has not improved the situation. What else could be causing the excessive
calls? How can we reduce the number of calls?
thanks
Bavini

"Bavini Naidoo" <[email protected]> wrote in message
news:3fc741c1$[email protected]..
>
We have an application served from WLS 6.0. Our current version of WLS is:
Service Pack 2 05/24/2001 11:55:28 #117037 RP3 for 6.0 SP2 02/21/200217:46:45
#167070
WLS has been configured to query an LDAP server for user authentication.The issue
we are experiencing is that WLS performs the LDAP query on EVERY page loadin
the application. This is resulting in excessive calls to the LDAP server,and
increased response times.
We have attempted to change the caching realm settings such that the cacheis
refreshed every 15 minutes as follows:
<CachingRealm AuthenticationCacheSize="601"
AuthenticationCacheTTLPositive="900" BasicRealm="X_LDAP"
CacheCaseSensitive="true" GroupMembershipCacheTTL="900"
Name="X_CACHE" UserCacheSize="601" UserCacheTTLPositive="900"/>
This has not improved the situation. What else could be causing theexcessive
calls? How can we reduce the number of calls?
Turn on weblogic.security.ldaprealm.verbose and see if the debugging output
indicates
the operation that the ldap realm is performing.

External mail configuration from SBWP

Hi
I need the steps to configuration of sending mails to external users (xxx.gmail.com) from SAP system using t-code SBWP.
Anyone please give me some steps to configure this.
Thanks & Regards,
Pradeep

Hi
I have configured using t-code SCOT. it is fine.
But when i tried to test the RFC connection from SM59, i am getting the following error:
ERROR                timeout during allocate
LOCATION             SAP-Gateway on host omddb / sapgw00
DETAIL               no connect of TP /sapmnt/OMD/exe/mailgwOMD.csh
COMPONENT            SAP-Gateway
COUNTER              31002
MODULE               gwr3cpic.c
LINE                 1795
RETURN CODE          242
SUBRC                    0
RELEASE              640
TIME                 Tue Sep 11 08:25:43 2007
VERSION              2
Please help me in this..
Pradeep

Authentication problem by external ldap server for WLS 7.0

Hi all,
I have configured iPlanet directory Server to serve as authentication security
provider for WLS 7.0.While doing so I have created a Test security realm and made
it as default.I have also configured the other default settings for the remaining
security providers for the realm.
Now, while I start the WLS with the default username and password, boot-error
comes as given below. As a matter of fact I have also created groups with relevant
username and pwd in the ldap server as specified bu the Bea documentation.
I have tried to remove the problem since last 4 days but all in fiasco.
If anybody has any pointer to the problem - it will be a great help.
The error :
* To start WebLogic Server, use a username and *
* password assigned to an admin-level user. For *
* server administration, use the WebLogic Server *
* console at http://[hostname]:[port]/console *
D:\bea\weblogic700\samples\server\config\petstore>"D:\bea\jdk131_03\bin\java"
-h
otspot -Xms32m -Xmx200m -Dpet.mode= - Dweblogic.management.discover=false -Dweblo
gic.Name=petstoreServer -Dbea.home="D:\bea" -Dweblogic.management.username=weblo
gic -Dweblogic.management.password=weblogic -Dweblogic.ProductionModeEnabled=tru
e -Djava.security.manager -Djava.security.policy=="D:\bea\weblogic700\server\lib
\weblogic.policy" weblogic.Server
Starting WebLogic Server...
<Nov 19, 2002 10:08:04 AM IST> <Notice> <Management> <140005> <Loading configura
tion D:\bea\weblogic700\samples\server\config\petstore\.\config.xml>
<Nov 19, 2002 10:08:21 AM IST> <Notice> <Security> <090082> <Security initializi
ng using realm RitTestRealm.>
<Nov 19, 2002 10:08:22 AM IST> <Critical> <WebLogicServer> <000364> <Server fail
ed during initialization. Exception:java.lang.SecurityException: User weblogic
i
s not permitted to boot the server
java.lang.SecurityException: User weblogic is not permitted to boot the server
at weblogic.security.service.SecurityServiceManager.doBootAuthorization(
SecurityServiceManager.java:1076)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityS
erviceManager.java:1116)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31)
>
Regards,
Ritwik

Thanks Vijay - it has worked by creating the Administrator group in LDAP but Weblogic
documentation also states the creation of any group in Ldap server with the boot
username and pwd and then adding the group in the admin role of WLS7.0 - but this
did not work.
If there is any info regarding the same - pl. do let me know
Regards,
Ritwik
"Vijay" <[email protected]> wrote:
>
Ritwik,
I think WebLogic 7 requires a group called "Administrators" in the LDAP
server
and requires an user to be added to that group. I have this working in
one of
my projects. The group really doesnt need to be an LDAP administrative
group.
Can you provide any additional information. I might be able to help since
I got
this working only a coupla days back.
Vijay
"Ritwik Batabyal" <[email protected]> wrote:
Hi all,
I have configured iPlanet directory Server to serve as authentication
security
provider for WLS 7.0.While doing so I have created a Test security realm
and made
it as default.I have also configured the other default settings forthe
remaining
security providers for the realm.
Now, while I start the WLS with the default username and password, boot-error
comes as given below. As a matter of fact I have also created groups
with relevant
username and pwd in the ldap server as specified bu the Bea documentation.
I have tried to remove the problem since last 4 days but all in fiasco.
If anybody has any pointer to the problem - it will be a great help.
The error :
* To start WebLogic Server, use a username and *
* password assigned to an admin-level user. For *
* server administration, use the WebLogic Server *
* console at http://[hostname]:[port]/console *
D:\bea\weblogic700\samples\server\config\petstore>"D:\bea\jdk131_03\bin\java"
-h
otspot -Xms32m -Xmx200m -Dpet.mode= - Dweblogic.management.discover=false
-Dweblo
gic.Name=petstoreServer -Dbea.home="D:\bea" -Dweblogic.management.username=weblo
gic -Dweblogic.management.password=weblogic -Dweblogic.ProductionModeEnabled=tru
e -Djava.security.manager -Djava.security.policy=="D:\bea\weblogic700\server\lib
\weblogic.policy" weblogic.Server
Starting WebLogic Server...
<Nov 19, 2002 10:08:04 AM IST> <Notice> <Management> <140005> <Loading
configura
tion D:\bea\weblogic700\samples\server\config\petstore\.\config.xml>
<Nov 19, 2002 10:08:21 AM IST> <Notice> <Security> <090082> <Security
initializi
ng using realm RitTestRealm.>
<Nov 19, 2002 10:08:22 AM IST> <Critical> <WebLogicServer> <000364><Server
fail
ed during initialization. Exception:java.lang.SecurityException: User
weblogic
i
s not permitted to boot the server
java.lang.SecurityException: User weblogic is not permitted to bootthe
server
at weblogic.security.service.SecurityServiceManager.doBootAuthorization(
SecurityServiceManager.java:1076)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityS
erviceManager.java:1116)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31)
>
Regards,
Ritwik

Changing user password in the external LDAP server from weblogic

Hi !
We have been successful in configuring the ldap security realm from weblogic 7.0.
We have also done the user authentication.
Now we want to allow the user himself to change his password from the application.Can
the user password which is stored in an iplanet directory server be changed from
application?If yes , then is there any extra configuration that needs to be done

I am not sure whether u got an answer for this..
But iplanet provides a web-link for end-users to change their LDAP password...u
can just give this link in ur app ..and iplanet will take care of the rest..
Krish Venkataraman
Bank Of America Corp.
Senior Analyst
"Mitali" <[email protected]> wrote:
>
Hi !
We have been successful in configuring the ldap security realm from weblogic
7.0.
We have also done the user authentication.
Now we want to allow the user himself to change his password from the
application.Can
the user password which is stored in an iplanet directory server be changed
from
application?If yes , then is there any extra configuration that needs
to be done

How to access an External LDAP on a weblogic server using OPSS APIs.

Hi,
Can anyone let me know how I can access an External LDAP configured on a weblogic server using OPSS APIs( or alternative APIs).
I'm currently using the below snippet and I'm getting only the Users and groups from the DefaultAutheticator on the weblogic server and not the external LDAP Server.
I've verified the providers, users and groups on the weblogic server console and can see that external LDAP server content is being picked, but my below code does not query them.
import oracle.security.idm.IMException;
import oracle.security.idm.IdentityStore;
import oracle.security.idm.Role;
import oracle.security.jps.JpsContext;
import oracle.security.jps.JpsContextFactory;
import oracle.security.jps.JpsException;
import oracle.security.jps.service.idstore.IdentityStoreService;
List<Role> rowData = null;
JpsContextFactory ctxf = JpsContextFactory.getContextFactory();
JpsContext ctx = ctxf.getContext();
IdentityStoreService storeService = ctx.getServiceInstance(IdentityStoreService.class);
IdentityStore idStore = storeService.getIdmStore();
rowData = this.getRoles(idStore, "*");
Any help or pointers are highly appreciated.
Thanks,
Bhasker

Can anyone please provide any suggestions. I trying to google around but still not able to find any solution.
Thanks,
Bhasker

How to authenticate CXF-Webservice against external LDAP in WebLogic?

Hi there,
I'm trying to integrate our Camel-application into WebLogic 12c. All the incoming endpoints are CXF-based webservices. These are secured by "UsernameToken Timestamp" with the WSS4JInInterceptor configured like this:
<bean id="wss4jInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
          <constructor-arg>
               <map>
                    <entry key="action" value="UsernameToken Timestamp" />
                    <entry key="passwordType" value="PasswordDigest" />
                    <entry key="passwordCallbackClass"
                         value="de.mycompany.camel.cxf.UserTokenCallbackHandler" />
               </map>
          </constructor-arg>
</bean>
My problem is: WSS4JInInterceptor expects the UserTokenCallbackHandler to return the password of the user delivered in the header <wsse:Username>. Is there any way to retrieve this from an external LDAP configured in WebLogic? I've already managed to retrieve the users, groups etc with JMX (javax.management.MBeanServerConnection and weblogic.security.providers.authentication.LDAPAuthenticatorMBean), but I can't figure out how to authenticate the user against the LDAP, i. e. retrieve the password.
Or am I heading in a completely wrong direction and this is not the way to achieve authentication for CXF-Webservices in WebLogic?
Please give me a hint (code-snippets preferred ;-) ) how to solve this.
Regards,
Frank

I have run into the exact same situation ? Did you ever get around this ? If so, how ? Please let me know.

How to add user to external LDAP programmatically?

Hello.
I have portal application in JDeveloper. Here is code that adds user to WLS embedded LDAP:
JpsContextFactory jps = JpsContextFactory.getContextFactory();
JpsContext jpsContext = jps.getContext();
IdentityStoreService storeService = jpsContext.getServiceInstance(IdentityStoreService.class);
IdentityStore is = storeService.getIdmStore();
UserManager mn = is.getUserManager();
RoleManager rm = is.getRoleManager();
Principal p = mn.createUser(username,password.toCharArray()).getPrincipal();
Role r = is.searchRole(is.SEARCH_BY_NAME, "Administrators");
rm.grantRole(r, p);
But I also have external LDAP on my WLS. How can I add users to external LDAP programmaticaly?

System Preferences > Users & Groups > Unlock the lock on the bottom left > click the plus sign on the bottom left

Error while configuring external LDAP user store with weblogic

Hi,
I have weblogic 10.3 installed and I can access weblogic admin console using weblogic (admin) user. I want to use external ldap user store to access admin console with users present in external ldap.
To do this, I have configured authentication provider and provided all the required details to connect to ldap.
For example:
Base DN: cn=admin,cn=Administrators,cn=dscc (user with which we will connect to LDAP)
User DN: ou=People,dc=test,dc=com
Group DN: ou=Groups,dc=test,dc=com
This authentication provider is set to SUFFICIENT mode. I have deleted the default authentication provider.
In the boot.properties file I have given the user name and password of the user with which LDAP instance was created something like below.
password=xxxxxxx
username=admin
Now while starting the admin weblogic server, I am getting the below error:
<Jul 25, 2012 2:22:28 PM IOT> <Critical> <Security> <BEA-090402> <Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.>
<Jul 25, 2012 2:22:28 PM IOT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.doBootAuthorization(CommonSecurityServiceManagerDelegateImpl.java:960)
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1054)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
at weblogic.security.SecurityService.start(SecurityService.java:141)
at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
Truncated. see log file for complete stacktrace
Caused By: javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User admin javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User admin denied
at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)
at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
at java.security.AccessController.doPrivileged(Native Method)
at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Truncated. see log file for complete stacktrace
>
<Jul 25, 2012 2:22:28 PM IOT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
<Jul 25, 2012 2:22:28 PM IOT> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
<Jul 25, 2012 2:22:28 PM IOT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
Can anyone please suggest how to resolve this problem? If, anyone can suggest the exact steps to configure external ldap store to manage admin console via ldap users.
Regards,
Neeraj Tati.

Hi,
Please refer the below content that I found for Oracle 11g in the docs.
"If an LDAP Authentication provider is the only configured Authentication provider for a security realm, you must have the Admin role to boot WebLogic Server and use a user or group in the LDAP directory. Do one of the following in the LDAP directory:
By default in WebLogic Server, the Admin role includes the Administrators group. Create an Administrators group in the LDAP directory, if one does not already exist. Make sure the LDAP user who will boot WebLogic Server is included in the group.
The Active Directory LDAP directory has a default group called Administrators. Add the user who will be booting WebLogic Server to the Administrators group and define Group Base Distinguished Name (DN) so that the Administrators group is found.
If you do not want to create an Administrators group in the LDAP directory (for example, because the LDAP directory uses the Administrators group for a different purpose), create a new group (or use an existing group) in the LDAP directory and include the user from which you want to boot WebLogic Server in that group. In the WebLogic Administration Console, assign that group the Admin role."
Now in my LDAP directory, setup is in such a way that Administrators is a group created under following heirarchy " cn=Administrators,ou=Groups,dc=test,dc=com" and there is one user added in this Administrators group.
The problem that I am having is when I modify the Admin role in which Administrators group should be added what exaclty I should give in Admin role. Whether I should give only Administrators or full DN: cn=Administrators,ou=Groups,dc=test,dc=com ???
When i give full DN, it takes every attribute as different, i mean cn=Administrators as different and ou=Groups as different and shows a message that cn=Administrators does not exist.
Here not sure what to do.
Also if external ldap authentication provider is the only provider then I need to give the user information in boot.properties file also for weblogic to boot properly. Now, what should I give there in user? still complete DN ??
Regards,
Neeraj Tati.

Does WLS 8.1 support external ldap in read-only or full read/write?

In previous releases (e.g. 5.1, 6.1), WLS doesn't provide support for update operations such as creating users and groups when configured to use an external LDAP.
Has this changed in 8.1? In other words, does WLS 8.1 provide support for update operations?
Thanks.
Regards,
Alan Dupuis

Hello ,
Like earlier releases, WLS 8.1 too provides read-only access to External LDAP user database.
Kuldeep Singh.

Not authenticated from external ldap in a cluster

I am having trouble getting authenticated from an Iplanet LDAP, when the weblogic is configured in a Cluster.
-I can authenticate with Embedded LDAP domain wide
-I can authenticate on the external LDAP if I send the request to Admin server
Here is my cluster configuration (all with Weblogic 7.0 SP4)
*Admin Server Port: 9209
*Cluster server 1 : 7209
*Cluster server 2 : 8209
*Proxy server : 9090 (configured with HttpClusteredServlet)
http://myserver.com:9090/j_security_check fails
http://myserver.com:9209/j_security_check works
Please let me know what is wrong?

"Bob" <[email protected]> wrote in message
news:3f9fd466$[email protected]..
I am having trouble getting authenticated from an Iplanet LDAP, when theweblogic is configured in a Cluster.
-I can authenticate with Embedded LDAP domain wide
-I can authenticate on the external LDAP if I send the request to Adminserver
Here is my cluster configuration (all with Weblogic 7.0 SP4)
*Admin Server Port: 9209
*Cluster server 1 : 7209
*Cluster server 2 : 8209
*Proxy server : 9090 (configured with HttpClusteredServlet)
http://myserver.com:9090/j_security_check fails
http://myserver.com:9209/j_security_check works
Please let me know what is wrong?Are you sure that the ldap authentication is actually occuring? I would
define the
DebugSecurityAtn="true" attribute on the ServerDebug mbean for the cluster
server members and then look at the log and the ldap_trace.log files to see
what is happening with LDAP.

Fetching properties from external LDAP

Hi,
I have configured ActiveDirectoryAunthenticator to link to my external LDAP
provider. I am trying to fetch some properties/attributes related to the
profile such as company and other contact details.
I have not configured UUP as Im using weblogic's default user store.
Now, when I access "com.bea.p13n.controls.profile.UserProfileControl", to
fetch the properties I get null values.
Is there some other configuration required ?
Please let me know the solution or the approach.
Thanks in advance ,
Regards,
Arun

Hi Arun
Migration of data is possible
Export the data from external server and import into your domain server
Here is the steps
To export and import security data:
1.     Expand the Security-->Realms nodes.
2.     Click the name of the realm you are configuring (for example, TestRealm).
3.     Click the Migration-->Export tab.
4.     Specify the directory and filename in which to export the security data in
the Export Directory on Server attribute.
Note: You can specify a directory and file location on another server.
5.     Click Export.
6.     Expand the Realms node.
7.     Click the name of the security realm in which the security data is to be imported.
8.     Click the Migration-->Import tab.
9.     Specify the directory location and file name of the file that contains the
exported security data in the Import Directory on Server attribute.
10.     Click Import.
To verify the security data was imported correctly:
1.     Expand the Security-->Realms nodes.
2.     Click the name of the realm into which the security data was imported.
3.     Click Users.
4.     Users from the security realm from which you exported the security data should
appear in the Users table.
Cheers
Surya
"Arun A.G." <[email protected]> wrote:
Hi,
I have configured ActiveDirectoryAunthenticator to link to my external
LDAP
provider. I am trying to fetch some properties/attributes related to
the
profile such as company and other contact details.
I have not configured UUP as Im using weblogic's default user store.
Now, when I access "com.bea.p13n.controls.profile.UserProfileControl",
to
fetch the properties I get null values.
Is there some other configuration required ?
Please let me know the solution or the approach.
Thanks in advance ,
Regards,
Arun

How to configure webcenter services to use external LDAP?

Reassociating the identity store with an external LDAP server is mandatory only if you're using the Documents service and/or the Discussions service, in which case the WC_Spaces server, Content Server, and Collaboration server must all be configured to use the same external LDAP server.
The question is how to configure?
Is there any document which details this?
Please help! this is urgent.
Regards

Refer
http://docs.oracle.com/cd/E28280_01/webcenter.1111/e12405/wcadm_security_id_store.htm#WCADM1845
http://docs.oracle.com/cd/E28280_01/webcenter.1111/e12405/wcadm_security_id_store.htm#WCADM345
Thanks

Anyone configured OID with weblogic as external LDAP

Hey,
I need help from someone who configured Oracle Internet Directory with weblogic 7 or any version to us as external LDAP server.
Your Help is greatly appreciated.
Thanks & Best Regards,
Nagendra

I was able to use OID as external LDAP for my Weblogic. I was able to move the stuff from Weblogic Embedded LDAP to Oracle Internet Directory Server, I have done it by myself
Thanks
Nagendra

URGENT: external LDAP configuration from WLS 6.1

Similar Messages

Maybe you are looking for