Usage of default keyStores(.jks) in WLS production mode

Question

HI All,
I need confirmation on usage of default keystore(.jks)  on web logic servers 10.3.5 running in  PRODUCTION Mode ?
I have configured Demo-trust.jks and Demo-identity.jks  files in web logic server which is running on production mode  , but the below link says we should not use the demoidentity.jks and demotrust.jks file in Production and default key-stores for only testing.
In general, production mode requires you to configure additional security features.
FYi  ...http://oracle-solutions.com/en/configuration-ssl-weblogic-server/
FYI, Some of key web logic server log entries :
- The system is vulnerable to security attacks, since it trusts certificates signed by the demo trusted CA.
- <BEA-000330> <Started WebLogic Managed Server "bi_server1" for domain "bifoundation_domain" running in Production Mode>.
- Warning : domains\bifoundation_domain\servers\bi_server1\tmp\_WL_user\oracle.applcore.model\vy4gk6/META-INF/application.xml. A version attribute is required, but this version of the Weblogic Server will assume that the JEE5 is used. Future   versions of the Weblogic Server will reject descriptors that do not specify the JEE version.>
Basically  we are trying to implement the SSO between OBIEE11g  and j2e application in WLS 10.3.5   , I have completed the SAML2 configuration on two different managed servers ,but SSO not working and also not able to find ERROR messages on server logs
I would like to know ,  If we chose/use  default keystores  in WLS production mode , is there impact on SSO functionality (SAML2) ?
Thanks in Advance

Answer 1

Hi ,
Thanks for valuable input and after configuring I am able to see the SAML2.0 logs
In Web logic custom authentication provider configured for performing authentication on j2ee  application .    SS0-Saml2.0  configured in single web-logic server11g  ,in which  two different managed servers .(One managed server for application and another managed server for OBIEE).
We are able to login successfully on application side using the custom database authenticator (User: Tony) and then if we try to access the OBIEE urls(example: http://ctodomain.test.com:8704/saml2/analytics/saw.dll?) ,its redirecting to OBIEE URL as   http://ctodomain.test.com:8704/saml2/sp/acs/artifact?SAMLart=AAQAAP4DqhE1B5fw5nvpzoSbqW9KLgCPhgkl21qQKIG3naZsi9f75Uk8HdQ%3D   and WLS log says  “Authentication Failed: User ‘Tony’ denied
Looks like SAML token generating properly on IDP(app)  and not able to authenticate on service provider (OBIEE)
In order to achieve the SSO using SAML2.0 , do we need to configure any  steps at OBIEE side to bring the users in console ? , b’coz  below log says application user not able to login authenticate at OBIE E side .
OBIEE wls log:
Apr 13, 2015 11:18:39 PM IST> <Debug> <SecuritySAML2Service> <BLR00AFE> <bi_server1> <[ACTIVE] Execute-thread: '0' for queue: 'web-logic.kernel.Default (self-tuning)'> <<WLS Kernel>> <
<3c7a43ee732d37f3:4702fadb:14cb333962b:-8000-000000000000238c> <1428947319400> <BEA-000000> <exception info
javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User Download javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User Download denied
                at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)
                at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
                at java.security.AccessController.doPrivileged(Native Method)
                at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
                at sun.reflect.GeneratedMethodAccessor354.invoke(Unknown Source)
                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
                at java.lang.reflect.Method.invoke(Method.java:606)
Appreciate if any inputs on above issue
Thanks