Using fileReamd + custom realm w/ WLS6

Hi,
I would like to write a custom realm for WLS6.0, but I would like to
delegate to the fileRealm for WebLogic accounts, such as 'system'. Can
anyone suggest a straightforward way to accomplish this?
Thanks,
Dhiren
Dhiren Patel -- Sr. Web Architect -- Align Technology, Inc.

Duh. Momentary lapse of reason, please disregard.
Dhiren
Dhiren Patel wrote:
Hi,
I would like to write a custom realm for WLS6.0, but I would like to
delegate to the fileRealm for WebLogic accounts, such as 'system'. Can
anyone suggest a straightforward way to accomplish this?
Thanks,
Dhiren
Dhiren Patel -- Sr. Web Architect -- Align Technology, Inc.--
Dhiren Patel -- Sr. Web Architect -- Align Technology, Inc.

Similar Messages

Custom Realm in WLS6.1

Hello,
Has anyone implemented authentication & authorization with a Custome realm
in WLS 6.1.I need to implement a custom realm which accesses a policy director
to grant access to resources.Can anyone please help with some ideas?
btw,i went through the documentation of how to write a custom realm.i have a
question on the following code snippet
String userInfoFileName =
configData.getProperty("UserInfoFileName");
String groupInfoFileName =
configData.getProperty("GroupInfoFileName");
Where in the config do u need to specify values for the above mentioned properties.If
anyone has implemented Authentication and Authorization with a custom realm,can
u please help me with more explanation and a code snippet?
Thanks,
Kalyan

nope..
"Viswadas Leher" <[email protected]> wrote in message
news:3cebb4e1$[email protected]..
>
>
I have two web applications running in the same weblogic domain. Can Ispecify two
different custom realms to the web apps. If yes how?.
The only way i could get the custom realm class called by the server if ispecify
it as
<Realm CachingRealm="LeherCacheRealm"
FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
in the config.xml. This causes the weblogic users, such as "system" etc toget invalidated.
>
>
I tried using the following tags to specify it on a per application basis,which
doesnot seem to work . Am i missing something?
<CustomRealm Name="LeherRealm"RealmClassName="com.leher.security.weblogic.KinectaRealm"/>
<CachingRealm BasicRealm="LeherRealm" CacheCaseSensitive="true"Name="LeherCacheRealm"/>
<Application Deployed="true" Name="DummyApp" Path="F:\leher">
<WebAppComponent AuthRealmName="LeherCacheRealm"
Name="DummyApp" Targets="myserver" URI="dummyapp"/>
</Application>
Is it not possible to define different realms to different webapplications in the
same domain.?

Errors encountered when trying to use a Custom Realm on BEA Weblogic Platform Domain .....

Hi,
We have created a WebLogic Platform Domain. A WebLogic Portal application(Portal
7.0) and some Web Service apps are running on this domain.
We have created a Custom Security Realm b'cos of our application requirements
and now when I startup the Platform Domain, I see lot of errors.
Some of the errors typically are
"<Jan 16, 2003 4:07:02 PM EST> <Error> <HTTP> <101256> <The run-as user: wlisystem,
for the servlet: ApplicationView for the webapp: /WLI_AI_Workshop_Control_Web,
could not be resolved to a valid user in the system. Please check if the user
exists.
javax.security.auth.login.LoginException: Authentication Failed: User wlisystem
denied in Realm Adapter realm weblogic"
or
Unable to deploy EJB: wlai-eventprocessor-ejb.jar from wlai-eventprocessor-ejb.jar:weblogic.ejb20.WLDeploymentException:
weblogic.ejb20.interfaces.PrincipalNotFoundException: Authentication Failed: User
wlisystem denied in Realm Adapter realm weblogic
Do we have to create any predefined user accounts in the Security Store to get
rid of these errors. I would appreciate if anyone can suggest some tips or workarounds
for configuring or creating a Custom Security Realm for Web Logic Platform Domain.
Thanks
Vikram

with 7.0 try to create system in your custom realm.. that may help.
-kiran
"Vikram" <[email protected]> wrote in message
news:[email protected]...
>
Kiran,
First time around, the Custom realm was not authenticating the user. I gotthe
code to authenticate the user successfully. Now the WebLogic serverwouldn't even
start. It would give me an error message which says "User System is notauthorized
to boot Weblogic Server". For your reference, I am attaching the Log file.My
custom realm classes output some debugging statements in the log file.From the
log file u will see that the users are getting authenticated successfully.
Please let me know if you have a custom realm working for you. I might bemissing
something.
Appreciate your help.
Thanks
Vikram
"kirann" <[email protected]> wrote:
does your realm able to authenticate user "wlisystem".
thanks
kiran
"Vikram Datla" <[email protected]> wrote in message
news:[email protected]...
Hi,
We have created a WebLogic Platform Domain. A WebLogic Portalapplication(Portal
7.0) and some Web Service apps are running on this domain.
We have created a Custom Security Realm b'cos of our applicationrequirements
and now when I startup the Platform Domain, I see lot of errors.
Some of the errors typically are
"<Jan 16, 2003 4:07:02 PM EST> <Error> <HTTP> <101256> <The run-asuser:
wlisystem,
for the servlet: ApplicationView for the webapp:/WLI_AI_Workshop_Control_Web,
could not be resolved to a valid user in the system. Please check ifthe
user
exists.
javax.security.auth.login.LoginException: Authentication Failed: Userwlisystem
denied in Realm Adapter realm weblogic"
or
Unable to deploy EJB: wlai-eventprocessor-ejb.jar fromwlai-eventprocessor-ejb.jar:weblogic.ejb20.WLDeploymentException:
weblogic.ejb20.interfaces.PrincipalNotFoundException: AuthenticationFailed: User
wlisystem denied in Realm Adapter realm weblogic
Do we have to create any predefined user accounts in the Security Storeto
get
rid of these errors. I would appreciate if anyone can suggest sometips or
workarounds
for configuring or creating a Custom Security Realm for Web Logic
Platform
Domain.
Thanks
Vikram

WebLogic Server doesn't start after configuring a Custom Realm

Hi,
We are having problems getting WebLogic server to startup after configuring a
Custom Realm. It outputs the error message "User System not authorized to boot
WebLogic Server. Security Excpetion".
For debugging purposed we had our Custom Realm classes output some debug statements
to the console. From the output it was apparent that all the users were getting
authenticated properly including System, Administrator, wliSystem etc. But after
the initial authentications we get this error message. I am attaching the log
file for your reference. Do we have to implement Authorization also (by implementing
ACLImpl) in the Custom Realm. Our Custom Realm was planned to be used only for
authentication.
Appreciate any feedback on the cause of the problem.
Thanks
Vikram
[test.log]

Thanks Deyan. I will give it a try and let you know.
"Deyan D. Bektchiev" <[email protected]> wrote:
Vikram,
You should make your user that you use to startup the server a member
of
the Administrators group.
In other words there should be a Principal "Administrators" in the
Subject that your LoginModule returns.
I'm not sure if you can configure this afterwards but this is how it's
done out of the box.
Dejan
Vikram wrote:
Mike,
We are working with a Platform domain on Weblogic 7.0. When you implementa custom
realm it can be implemented just for authentication and not for authorization.
In our case we used the Custom Realm only for authentication. ACLs storeall the
authorization information. We assumed that the standard Weblogic useraccounts
like system, administrator are already part of the ACLs with the appropriateprivileges.
Please let me know if you have any suggestions.
Thanks
Vikram
"mike" <[email protected]> wrote:
You mix up authentication and authorization. The fact that a user is
a valid user
(authentication) does not guarantee that he/she can perform a certain
action (authorization).
The second is defined by ACLs or something, which is probably (most
likely)
not
set in your case. To go on ranting I need to know which version youare
on (looks
like 7, grey area for me).
"Vikram" <[email protected]> wrote:
Hi,
We are having problems getting WebLogic server to startup after configuring
a
Custom Realm. It outputs the error message "User System not authorized
to boot
WebLogic Server. Security Excpetion".
For debugging purposed we had our Custom Realm classes output some
debug
statements
to the console. From the output it was apparent that all the userswere
getting
authenticated properly including System, Administrator, wliSystemetc.
But after
the initial authentications we get this error message. I am attaching
the log
file for your reference. Do we have to implement Authorization also
(by
implementing
ACLImpl) in the Custom Realm. Our Custom Realm was planned to be used
only for
authentication.
Appreciate any feedback on the cause of the problem.
Thanks
Vikram

My own Realm instead of Custom Realm extends IASRealm ?

I understand that the custom realm the sun app 7 offers is an extension of ISARealm where authenticate() is overloaded.
But authenticate() does only return a list of groups.
I want to return my own User class with interface Principle.
May I implement my own Realm implementation as a substitute for IASRealm, LdapRealm etc. ?
I know how to implement a JAASRealm for Tomcat because I did it and I want to use it on sun app 7 too.
Thanks,
Frerk

I don't know for sure, but I would suggest changing the user.dn
attribute. For example, I had o= yyy, ou=xxx, ou =xyz in LDAPV1 and in
LDAPV2 I have ou=xxx, o=yyy. So, I had to drop one 'ou' and put the ou
first.
Brynjar Glesnes wrote:
>
Hi,
When migrating from Weblogic 6.0 to Weblogic 6.1sp1 I want to use a
Custom Realm instead of the deprecated LDAP Realm. We are using
Netscape Directory Server 4.1. So I modify the Netscape template. I
get no warnings or errors when starting WLS and my groups are listed
in Groups in the Console. But when I try to authenticate a user
authentication fails. When I set up a LDAP Realm as before it succeeds
for the same user and operation.
I have browsed this usenet group without finding the solution. Do
anybody have a clue?
Here is the entry in config.xml for the Custom Realm:
<CustomRealm
ConfigurationData="user.filter=(&(uid=%u)(objectclass=person));user.dn=ou=People,
o=entraoslo.entra.no;membership.filter=(&(uniquemember=%M)(objectclass=groupofuniquenames));server.principal=uid=admin,
ou=Administrators, ou=TopologyManagement,
o=NetscapeRoot;group.filter=(&(cn=%g)(objectclass=groupofuniquenames));group.dn=ou=Groups,
o=entraoslo.entra.no;server.host=xxx.xxx.xxx.xxx"
Name="TakeCargoRealm"
Password="{3DES}ptTZvPU0y3CR76DZQZ8pqw=="
RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"/>
The entry in config.xml for the LDAP Realm:
<LDAPRealm AuthProtocol="simple"
Credential="{3DES}ptTZvPU0y3CR76DZQZ8pqw=="
GroupDN="o=entraoslo.entra.no, ou=Groups"
GroupIsContext="false"
GroupUsernameAttribute="uniquemember"
LDAPURL="ldap://xxx.xxx.xxx.xxx:389"
Name="TakeCargoDeprecatedRealm"
Principal="uid=admin, ou=Administrators,
ou=TopologyManagement, o=NetscapeRoot"
UserAuthentication="local"
UserDN="o=entraoslo.entra.no, ou=People"
UserNameAttribute="uid"/>
Any help would be appreciated.
Regards,
Brynjar Glesnes

Custom Realm using LDAP?

Hi,
has anyone implemented a custom realm using LDAP? I was suprised to learn that
ACLs are not supported in the LDAPRealm. Our corporate direction is to have a
central LDAP security store - including ACLs. Unfortunately the LDAP server is
MS SiteServer! Anyway, I assume this means I need to implement a custom realm
- unless there is an alternative.
-chris

You are correct - you'll need to write a custom
realm to do this.
-Tom
"Chris Jones" <[email protected]> wrote:
>
Hi,
has anyone implemented a custom realm using LDAP? I was suprised to
learn that
ACLs are not supported in the LDAPRealm. Our corporate direction is
to have a
central LDAP security store - including ACLs. Unfortunately the LDAP
server is
MS SiteServer! Anyway, I assume this means I need to implement a custom
realm
- unless there is an alternative.
-chris

Unable to use a custom security realm with Netscape Directory Server in WebLogic 7

I have all users and groups stored in a Netscape LDAP server (version 4.1.6 on
Solaris 8), so I want to create a custom security realm in WebLogic 7 (also run
on Solaris 8) which uses my LDAP server as the Authenticator. I tried this by
using the Admin Console and followed exactly the steps in Chapter 3 of the "Managing
WebLogic Security" doc. However, when I rebooted WebLogic and logged into the
Admin Console again and clicked the Users node under my custom realm, I saw this
message in the right-hand pane: "There are no Authentication providers available
that support the creation of Users". Also, I don't see my custom realm in the
dropdown list under mydomain -> Security tab -> General tab -> Default Realm.
What did I do wrong? Also, where does WebLogic store the custom security realm
info? It is definitely not in config.xml.
Thanks,
Eric Ma

Thanks for the info.
I wonder when they will fix it.
Jakub
U¿ytkownik "Eric Ma" <[email protected]> napisa³ w wiadomo¶ci
news:[email protected]..
>
According to BEA Tech Support, a known bug prevents the WLS 7 AdminConsole from
displying users and groups defined in Netscape Directory Server.
Eric Ma
"Jakub Wroniszewski" <[email protected]> wrote:
I have the same problem.
Any new ideas?
Rgds,
Jakub
U¿ytkownik "Eric Ma" <[email protected]> napisa³ w wiadomo¶ci
news:[email protected]..
Now I doubt my custom security realm is actually using the NetscapeDirectory Server
as the authenticator. Unlike in WebLogic 6.1 Admin Console, whereclicking on
the Users node displays all users in the LDAP server, in WebLogic 7I keep
getting
the message "There are no Authentication providers available that
support
the
creation of Users." Any suggestions?
"Eric Ma" <[email protected]> wrote:
Never mind. I tried again by following the steps outlined at
http://newsgroups.bea.com/cgi-bin/dnewsweb?cmd=article&group=weblogic.deve
l
oper.interest.security&item=8463&utag=
and it seemed to have worked for me.
"Eric Ma" <[email protected]> wrote:
I have all users and groups stored in a Netscape LDAP server (version
4.1.6 on
Solaris 8), so I want to create a custom security realm in WebLogic7
(also run
on Solaris 8) which uses my LDAP server as the Authenticator. I
tried
this by
using the Admin Console and followed exactly the steps in Chapter3
of
the "Managing
WebLogic Security" doc. However, when I rebooted WebLogic and logged
into the
Admin Console again and clicked the Users node under my custom realm,
I saw this
message in the right-hand pane: "There are no Authentication
providers
available
that support the creation of Users". Also, I don't see my customrealm
in the
dropdown list under mydomain -> Security tab -> General tab ->
Default
Realm.
What did I do wrong? Also, where does WebLogic store the customsecurity
realm
info? It is definitely not in config.xml.
Thanks,
Eric Ma

Custom Realm for SJSAS 9.x using JAAS documentation too vague

Hello there,
I am trying to implement a custom realm for a particular web application on my SJSAS 9.x server. So far I have been unsuccessful and receive the following message in my server.log:
[#|2006-10-20T13:51:56.390-0300|INFO|sun-appserver-pe9.0|javax.enterprise.system.core.security|_ThreadID=11;_ThreadName=httpWorkerThread-8080-1;javious;|SEC5046: Audit: Authentication refused for [javious].|#]
The documentation I have been using for reference is at:
http://docs.sun.com/app/docs/doc/819-3659/6n5s6m58k?a=view#beabs
However, I have a number of questions.
First of all, this section referenced by the URL above is identified as "Creating a custom realm". Then the second sentence of this section states "Note that client-side JAAS login modules are not suitable for use with the Application Server". Does this not mean that JAAS login modules are not suitable for use with SJSAS web applications since they are components of the Application Server? Is there a reason for providing information on creating a custom realm for this application server in which it is not suitable for? Why isn't it suitable for the application server? What if I want to implement my own realm for my web application so that I can maintain my application users separately in another application?
Secondly, this section explains that I can create a custom realm simply by creating a custom JAAS login module and a custom realm class. It then goes on to explain how to construct these classes and what to include in them. Notably, the documentation states the following:
The authenticateUser() method must end with the following sequence:
String[] grpList;
// populate grpList with the set of groups to which
// _username belongs in this realm, if any
return commitUserAuthentication(_username, _password,
_currentRealm, grpList);Having looked at the API for authenticateUser I discovered that it is a void method, however the documentation states to return a value from "commitUserAuthentication(..). Also, my commitUserAuthentication method only excepts a single argument of type String[] representing a list of group names, therefore I am unable to supply the additional arguments as documented. This is confusing.
Once finished reading the documentation, I am left hanging with hardly a clue as to what to do with these two new classes. Now having implemented a custom login module on Tomcat 5.x in earlier days, I did happen to have some experience to know to edit the security.properties, policy, and login.conf files. So anyhow from here I end up stumbling blindly through configuration of my domain1/login.conf and domain1/server.policy files. I also attempted to add my new realm within the admin console under security/realms and dropped my new jar file (with two classes) into the app server lib directory.
All in all, this completely fails to work. I have even placed System.out.println statements in all of my implemented methods and none of this actually shows up in my server.log file. Why is this section so vague? Why isn't there a step-by-step example from start to finish of how to implement a simple custom realm in SJSAS9?
Does anybody have any helpful suggestions?

Well, once again, I'm going to have to provide my own answer.
After much waiting and then deciding to invest much time researching documentation and tracking down information to assist in my solution, I have manage to find the golden egg for my own recipe of a solution.
In addition to the very helpful info I have found at:
http://developers.sun.com/prodtech/appserver/reference/techart/as8_authentication/index.html
I have mange to get my custom realm to work with the additional configuration of my sun-application.xml for my ear file. Even though I only wanted to specify my custom realm for my web.xml file, it turns out that in addition to this, I had to also define it in my sun-application.xml file (manually in XML text mode - within Netbeans 5.5) as follows:
<sun-application>
    <realm>mycustrealm</realm>
    <security-role-mapping>
        <role-name>mycust_role</role-name>
        <group-name>mycust_group</group-name>
    </security-role-mapping>
</sun-application>

How to access "Alternative Realm" or "Custom Realm" from components like Servlet ?

Hello,
Says if I have alternative realm or my custom realm which implement
"ManageableRealm" interface. How can I access the realm from other
component, like Servlet or EJB in same WLS ? I tried using code like this
BasicRealm realm =
Realm.getRealm("XmlRealm","weblogic","myclass.DebugRealm");
if (realm != null) {
Class realmClass = realm.getClass();
out.println("Realm is " + realmClass.getName());
Which "myclass.DebugRealm" is classname of my own realm. This realm works
fine when using for authentication and authorization. But when I run this
code on servlet, it seems that it doesn't return the realm it created when
starting WLS, I mean the one that served authentication and authorization.
But it create a new instance of this class (I knew it 'cos I put debug
message in its constructor). So how can I get reference to the realm
instance which is created when starting WLS ?
Thank you in an advance,
Siros

Hello again,
Sorry to say that now I've got the way. I post here again for someone who
may face that same problem.
So strange that, I just changed the realm name in below code to "custom" and
then it works !! My realm is extended from "AbstractListableRealm" class and
I think I named my realm as "XmlRealm" in it constructor by call
super("XmlRealm");
But seems like its "getName()" method always return "custom", so in servlet
code, it' rather be.
BasicRealm realm = Realm.getRealm("custom");
if (realm != null) {
Class realmClass = realm.getClass();
out.println("Realm is " + realmClass.getName());
This works fine and no instance of realm is created. Anyway I saw that
constructor of "AbstractListableRealm" take String argument for "name" of
the realm. So why it's always "custom" ???
Comments are welcome,
Siros
"Siros Supavita" <[email protected]> wrote in message
news:[email protected]..
Hello,
Says if I have alternative realm or my custom realm which implement
"ManageableRealm" interface. How can I access the realm from other
component, like Servlet or EJB in same WLS ? I tried using code like this
BasicRealm realm =
Realm.getRealm("XmlRealm","weblogic","myclass.DebugRealm");
if (realm != null) {
Class realmClass = realm.getClass();
out.println("Realm is " + realmClass.getName());
Which "myclass.DebugRealm" is classname of my own realm. This realm works
fine when using for authentication and authorization. But when I run this
code on servlet, it seems that it doesn't return the realm it created when
starting WLS, I mean the one that served authentication and authorization.
But it create a new instance of this class (I knew it 'cos I put debug
message in its constructor). So how can I get reference to the realm
instance which is created when starting WLS ?
Thank you in an advance,
Siros

Authorization with custom realm

Hello,
I have created a custom realm to access user and role information stored in a database. It is working fine for authentication. However, the Subject, Principal, and roles/groups do not seem to be used for later authorization steps. How should this information be stored so that the containers can access it?
In particular, when enabling security constraints in web.xml to limit the access of a particular url to a particular role, that url can never be accessed. The server generates messages implying that the user is not logged in:
Checking Web Permission with Principals : null
Checking with Principal : nonlogin-principal
Any suggestions on how to appropriately store the login information would be appreciated.
Thanks!

I have had a custom realm that handles ACLs since 5.1. My question is I want to
mix it with the out-of-the box ldaprealm v2. I was hoping for a failover mechanism
where I can supply a custom realm that knows how to authorize and leave it up
to the canned ldaprealm to authenticate. The filerealm behaves in such a manner,
does it not.
I will try your idea about extending the ldaprealm. But, the challenge will be
in dealing with the delegate.
"Utpal" <[email protected]> wrote:
If you extend the weblogic.security.ldaprealmv2.LDAPRealm and implements
newAcl, deleteAcl, newPermission,
setPermission etc, I think it's doable.
=========
public class weblogic.security.ldaprealmv2.LDAPRealm extends
weblogic.security.a
cl.AbstractListableRealm implements weblogic.security.acl.DebuggableRealm
=========
-utpal
"Utpal" <[email protected]> wrote in message
news:[email protected]..
Why don't you use the Custom Security Realm? You can construct an ACLin a
custom seecurity realm.
http://edocs.beasys.com/wls/docs61/security/prog.html#1042361
-utpal
"Ziad Kurdi" <[email protected]> wrote in message
news:3c9b4c80$[email protected]..
Is there a way in 6.1 to use the supplied LDAP Realm V2 for
authentication
and
managing groups, but enhance it with ACL's (stored in a database)
for
authorization?
Obviously, I would like to take advantage of the server's caching
realm
capabilities.
I currently running a custom realm (from 5.1 which works in 6.1)
that
mixes LDAP
authentication, group management, and DB ACL's for authorization,
but I
no
longer
wish to capture the user's password (due to sorporate policies) and
would
like
to avoid maitaining the authentication code.
Thanks in advance for any assistance.

Help with Weblogic 6 sp1 Custom Realm !!!!

We are trying to run Weblogic 6.0 sp1 with our current environment (ejb 1.1, custom
security realm)
We can compile and deploy our ejb 1.1 beans. We wish to start with ejb1.1 and
move to ejb2.0 once we can get our custom security working.
The JDBC connection pools are fine.
Our custom security realm uses LDAP for user authentication and an Oracle table
for authorization (acls).
Earlier, I wrote to the board and received the below following instructions to
use our existing custom realm in wl 60. You can read below, but I followed these
instructions on Solaris 5.6.
1. I ensured the SunOS patches were up to date.
2. We ensured the LD_LIBRARY_PATH reflected weblogic 6 (and not 5.1). We moved
the 5.1 classes over to wl6.
3. We copied our custom realm properties file to the weblogic root and/or the
config subdirectory (tried them both).
4. We ensured the security realm class we wrote is in the classpath (we bunch
all our serverside classes in a jar file anyway).
5. Then we created a custom realm via the console – name BFXRealm and it’s
class name <package>.BFXRealm, left configuration box blank.
6. Then we created a custom caching realm BFXCachingREalm and set its basic realm
as the custom realm, BFXRealm. All of the enable caches are checked to true.
7. Then we set the default realm to the BFXCachingRealm.
Now, when we perform a query, the everyone group should be implied. We don’t
implement LDAP lookup on queries. If I try to run a query from a client, I see
the client box connecting with the server:
Last line - you can see the client box connecting to the server -
<May 30, 2001 2:20:07 PM EDT> <Info> <J2EE> <Deployed : DefaultWebApp_myserver>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <WebLogic Server started>
<May 30, 2001 2:20:07 PM EDT> <Info> <Configuration Management> <Backed up booted
configuration /opt/apps/weblogic/beasp1/wlserver6.0sp1/./config/mydomain/config.xml
at /opt/apps/weblogic/beasp1/wlserver6.0sp1/./config/mydomain/config.xml.booted>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <ListenThread listening
on port 7001>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <SSLListenThread listening
on port 7002>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <System has file
descriptor limits of - soft: '1024', hard: '1024'>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <Using effective
file descriptor limit of: '1024' open sockets/files.>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <Allocating: '3'
POSIX reader threads>
<May 30, 2001 2:20:23 PM EDT> <Info> <HTTP> <[HTTP myserver] Created log stream
/opt/apps/weblogic/beasp1/wlserver6.0sp1/config/mydomain/logs/access.log>
<May 30, 2001 2:21:50 PM EDT> <Info> <WebLogicServer> <Adding address: 152.51.164.233/152.51
The client receives the error:
javax.naming.AuthenticationException. Root exception is java.lang.SecurityException:
Authentication
for user aws4270 denied in realm weblogic
It’s as if the fileRealm.properties is only being looked at. We do not
use this for our user/groups/acls in wl5.1.0 and we do not want to in wl6
For “fun”, I added a user to the fileRealm.properties file via the
console and ran a client query. It worked.
But when I tried to call an ejbCreate from the client, I received these errors
from the server:
BFXSecurityRealmException is a custom exception we have written. A query works
but a create does not - obviously cannot get to acl in database (?)
and why the ejb20 errors? We just want to start with ejb 1.1
In SeqStoreSecurityHelper.isUserAuthorized(): schema = seqStore.INTNUC, class
= bioseq, project = HIPPI, permission = create
<May 30, 2001 2:50:10 PM EDT> <Info> <EJB> <EJB Exception in method: ejbCreate:
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBean.ejbCreate(BioSequenceBean.java:1562)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanImpl.ejbCreate(BioSequenceBeanImpl.java:833)
at java.lang.reflect.Method.invoke(Native Method)
at weblogic.ejb20.manager.DBManager.create(DBManager.java:408)
at weblogic.ejb20.internal.EntityEJBHome.create(EntityEJBHome.java:353)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanHomeImpl.create(BioSequenceBeanHomeImpl.java:111)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanHomeImpl_WLSkel.invoke(BioSequenceBeanHomeImpl_WLSkel.java:78)
at weblogic.rmi.internal.BasicServerAdapter.invoke(BasicServerAdapter.java:373)
at weblogic.rmi.cluster.ReplicaAwareServerRef.invoke(ReplicaAwareServerRef.java:128)
at weblogic.rmi.internal.BasicServerAdapter.invoke(BasicServerAdapter.java:237)
at weblogic.rmi.internal.BasicRequestHandler.handleRequest(BasicRequestHandler.java:118)
at weblogic.rmi.internal.BasicExecuteRequest.execute(BasicExecuteRequest.java:17)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:137)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
The client receives the error:
java.rmi.RemoteException: EJB Exception:; nested exception is:
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
o
ccurred.
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
HOW CAN WE GET THE SERVER TO BYPASS FILEREALM and use BFXREALM ???????????
Thanks,
Anne
Subject: Re: Do Custom Security Realms have to use Mbeans?
Date: 17 May 2001 06:38:23 -0800
From: "Tom Moreau" <[email protected]>
Newsgroup: weblogic.developer.interest.security
Yes this can be done. Here's how:
1) I'll assume that the classname to your custom realm is "com.yourcompany.YourCustomRealm"
2) I'll assume that your custom realm has some kind of properties file from which
it reads its configuration data. Let's call this file "YourCustomRealm.properties"
3) Copy YourCustomRealm.properties to every machine that you're running wls on
(you are probably already doing this today).
4) Make sure that com.yourcompany.YourCustomRealm is in the classpath when you
start wls (you should already be doing this today)
5) In 5.1, there used to be some utility classes that customers used for their
custom realms - something about Pools & Factories. These have been renamed in
6.0. If you're using these classes, then go to your 5.1 weblogic jar file and
pull out these classes and add them to your classpath for 6.0.
6) In the console, create a custom realm and set it's realm class name to com.yourcompany.YourCustomRealm.
Leave the configuration data section blank.
7) In the console, configure your custom realm as the alternate realm. That is,
create a caching realm and set it's basic realm to your custom realm, then set
the realm's caching realm to the caching realm you just created.
I'm pretty sure this should work for you. We did this to provide a patch that
let 6.0 users uses the LDAPRealm rewrite from 5.1.
The downside is that you don't get single point of administration - that is, you
have to make your custom realm's configuration data (YourCustomRealm.properties)
available on all the machines you're running WLS on. If you rework your custom
realm, then the configuration data gets put in the custom realm configuration
you create via the console and automatically copied to other machines for you.
- Tom

We are trying to run Weblogic 6.0 sp1 with our current environment (ejb 1.1, custom
security realm)
We can compile and deploy our ejb 1.1 beans. We wish to start with ejb1.1 and
move to ejb2.0 once we can get our custom security working.
The JDBC connection pools are fine.
Our custom security realm uses LDAP for user authentication and an Oracle table
for authorization (acls).
Earlier, I wrote to the board and received the below following instructions to
use our existing custom realm in wl 60. You can read below, but I followed these
instructions on Solaris 5.6.
1. I ensured the SunOS patches were up to date.
2. We ensured the LD_LIBRARY_PATH reflected weblogic 6 (and not 5.1). We moved
the 5.1 classes over to wl6.
3. We copied our custom realm properties file to the weblogic root and/or the
config subdirectory (tried them both).
4. We ensured the security realm class we wrote is in the classpath (we bunch
all our serverside classes in a jar file anyway).
5. Then we created a custom realm via the console – name BFXRealm and it’s
class name <package>.BFXRealm, left configuration box blank.
6. Then we created a custom caching realm BFXCachingREalm and set its basic realm
as the custom realm, BFXRealm. All of the enable caches are checked to true.
7. Then we set the default realm to the BFXCachingRealm.
Now, when we perform a query, the everyone group should be implied. We don’t
implement LDAP lookup on queries. If I try to run a query from a client, I see
the client box connecting with the server:
Last line - you can see the client box connecting to the server -
<May 30, 2001 2:20:07 PM EDT> <Info> <J2EE> <Deployed : DefaultWebApp_myserver>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <WebLogic Server started>
<May 30, 2001 2:20:07 PM EDT> <Info> <Configuration Management> <Backed up booted
configuration /opt/apps/weblogic/beasp1/wlserver6.0sp1/./config/mydomain/config.xml
at /opt/apps/weblogic/beasp1/wlserver6.0sp1/./config/mydomain/config.xml.booted>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <ListenThread listening
on port 7001>
<May 30, 2001 2:20:07 PM EDT> <Notice> <WebLogicServer> <SSLListenThread listening
on port 7002>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <System has file
descriptor limits of - soft: '1024', hard: '1024'>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <Using effective
file descriptor limit of: '1024' open sockets/files.>
<May 30, 2001 2:20:08 PM EDT> <Info> <Posix Performance Pack> <Allocating: '3'
POSIX reader threads>
<May 30, 2001 2:20:23 PM EDT> <Info> <HTTP> <[HTTP myserver] Created log stream
/opt/apps/weblogic/beasp1/wlserver6.0sp1/config/mydomain/logs/access.log>
<May 30, 2001 2:21:50 PM EDT> <Info> <WebLogicServer> <Adding address: 152.51.164.233/152.51
The client receives the error:
javax.naming.AuthenticationException. Root exception is java.lang.SecurityException:
Authentication
for user aws4270 denied in realm weblogic
It’s as if the fileRealm.properties is only being looked at. We do not
use this for our user/groups/acls in wl5.1.0 and we do not want to in wl6
For “fun”, I added a user to the fileRealm.properties file via the
console and ran a client query. It worked.
But when I tried to call an ejbCreate from the client, I received these errors
from the server:
BFXSecurityRealmException is a custom exception we have written. A query works
but a create does not - obviously cannot get to acl in database (?)
and why the ejb20 errors? We just want to start with ejb 1.1
In SeqStoreSecurityHelper.isUserAuthorized(): schema = seqStore.INTNUC, class
= bioseq, project = HIPPI, permission = create
<May 30, 2001 2:50:10 PM EDT> <Info> <EJB> <EJB Exception in method: ejbCreate:
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBean.ejbCreate(BioSequenceBean.java:1562)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanImpl.ejbCreate(BioSequenceBeanImpl.java:833)
at java.lang.reflect.Method.invoke(Native Method)
at weblogic.ejb20.manager.DBManager.create(DBManager.java:408)
at weblogic.ejb20.internal.EntityEJBHome.create(EntityEJBHome.java:353)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanHomeImpl.create(BioSequenceBeanHomeImpl.java:111)
at com.gw.bioinfo.ejb.bioSeq.BioSequenceBeanHomeImpl_WLSkel.invoke(BioSequenceBeanHomeImpl_WLSkel.java:78)
at weblogic.rmi.internal.BasicServerAdapter.invoke(BasicServerAdapter.java:373)
at weblogic.rmi.cluster.ReplicaAwareServerRef.invoke(ReplicaAwareServerRef.java:128)
at weblogic.rmi.internal.BasicServerAdapter.invoke(BasicServerAdapter.java:237)
at weblogic.rmi.internal.BasicRequestHandler.handleRequest(BasicRequestHandler.java:118)
at weblogic.rmi.internal.BasicExecuteRequest.execute(BasicExecuteRequest.java:17)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:137)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
The client receives the error:
java.rmi.RemoteException: EJB Exception:; nested exception is:
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
o
ccurred.
com.gw.bioinfo.exception.BFXSecurityRealmException: BFX-90000: A BFXSecurityRealmException
occurred.
HOW CAN WE GET THE SERVER TO BYPASS FILEREALM and use BFXREALM ???????????
Thanks,
Anne
Subject: Re: Do Custom Security Realms have to use Mbeans?
Date: 17 May 2001 06:38:23 -0800
From: "Tom Moreau" <[email protected]>
Newsgroup: weblogic.developer.interest.security
Yes this can be done. Here's how:
1) I'll assume that the classname to your custom realm is "com.yourcompany.YourCustomRealm"
2) I'll assume that your custom realm has some kind of properties file from which
it reads its configuration data. Let's call this file "YourCustomRealm.properties"
3) Copy YourCustomRealm.properties to every machine that you're running wls on
(you are probably already doing this today).
4) Make sure that com.yourcompany.YourCustomRealm is in the classpath when you
start wls (you should already be doing this today)
5) In 5.1, there used to be some utility classes that customers used for their
custom realms - something about Pools & Factories. These have been renamed in
6.0. If you're using these classes, then go to your 5.1 weblogic jar file and
pull out these classes and add them to your classpath for 6.0.
6) In the console, create a custom realm and set it's realm class name to com.yourcompany.YourCustomRealm.
Leave the configuration data section blank.
7) In the console, configure your custom realm as the alternate realm. That is,
create a caching realm and set it's basic realm to your custom realm, then set
the realm's caching realm to the caching realm you just created.
I'm pretty sure this should work for you. We did this to provide a patch that
let 6.0 users uses the LDAPRealm rewrite from 5.1.
The downside is that you don't get single point of administration - that is, you
have to make your custom realm's configuration data (YourCustomRealm.properties)
available on all the machines you're running WLS on. If you rework your custom
realm, then the configuration data gets put in the custom realm configuration
you create via the console and automatically copied to other machines for you.
- Tom

Custom realm in wl 5.1

Leaves have created a custom realm based on the RDBMSRealm example in
weblogic. How does the user name and password propagate from the client to
the ejb. Do I need to put this info as a User in the context. Any help
will be great
Thanks
Monica Pradhan

"beaglebuddy" <[email protected]> wrote in message
news:3f4394e9$[email protected]..
>
I have a web app that uses BASIC authentication.
What I want is for the standard web app login box to be used,
but then I want to use a custom database table to verify the usernamepassword.
How do I do this in weblogic 8.1.On dev2dev, there is a sample dbms authentication provider that you can use
as a starting point
for a custom provider. You then configure this authentication provider in
WLS and authentication
will be handled by your provider.

While implementing sample custom realm, got ClassNotFound exception

I am trying to get the sample custom realm work. I followed every step in the documentation and had it deployed successfullyl. When I tried to log in, the authentication failed. Then I restarted the SunOne appserver, in the server.log file I got the error:
[22/Jul/2003:09:34:24] WARNING (24887): SEC1100: Disabled realm [jdbc] due to errors.
[22/Jul/2003:09:34:24] WARNING (24887): SEC1000: Caught exception.
com.sun.enterprise.security.auth.realm.BadRealmException: java.lang.ClassNotFoundException: samples.security.jdbcrealm.JDBCRealm
at com.sun.enterprise.security.auth.realm.Realm.doInstantiate(Realm.java:350)
at com.sun.enterprise.security.auth.realm.Realm.instantiate(Realm.java:284)
at com.iplanet.ias.security.RealmConfig.createRealms(RealmConfig.java:95)
at com.sun.enterprise.security.RealmManager.init(RealmManager.java:91)
at com.sun.enterprise.server.J2EEServer.startAuthenticationService(J2EEServer.java:1211)
at com.sun.enterprise.server.J2EEServer.run(J2EEServer.java:391)
at com.sun.enterprise.server.J2EEServer.main(J2EEServer.java:1415)
at com.iplanet.ias.server.ApplicationServer.onInitialization(ApplicationServer.java:212)
at com.iplanet.ias.server.J2EERunner.confPreInit(J2EERunner.java:114)
Since I am new to this, I couldn't locate the problem after checking everything many times. Can anyone help me? I need to get this part work first, then I can move ahead and make changes.
Thanks a million!

Thanks a lot, I did it and it worked.
I have more questions. For the custom realm database, I want to use a table just for username and password, and another table just for roles. Then use a third table as a bridge between the two. Can I do it in the sample application? Can I change JDBCLoginModule to do this? If yes, Where to put JDBCLoginModule and JDBCRealm after changes?
Really appreciate your help.

Creating a custom realm for tomcat. Help and suggestions please.

Has anybody ever created a custom realm to authenticate users in tomcat.
I would like to use form based login with my own realm.
The form requires 3 fields to log in (hence the custom realm) . I would also like to be able to use the built-in functions like isuserinrole.
If anybody has experience with this or knows of a place where to get valuable information please let me know.
Thanks in advance!

Hi
Tomcatx.x.x uses the realm sandbox security tecnique
1)In you'r abcd/web-inf/WEB.xml file
write the realm config scripts for the required
jsp/servlet pages[similar will be found in
Tomcat/webapps/examples/web-inf/web.xml]
2)In Tomcatx.x.x/conf/tomcat_users.xml
declare the realm id/pass/roles
3)If still not able to do then study the web.xml (pdf)
avaliable at websiter http://www.moreservlets.com

Custom Realm

I would want to write a Custom Security Realm, that uses
- NT domain for authentication and
- RDBMS realm for authorization
I do not see any API to access NT Domain users, should I use JCOM
Kindly Suggest. Thank you

Aseem,
Did you configure the Caching and file realms with your custom realm?
See also:
http://e-docs.bea.com/wls/docs61/adminguide/cnfgsec.html#1069864
Hope this helps,
Bart
Aseem Rastogi wrote:
Hi All,
I wrote a Custom Realm, according to the specification given on the
Weblogic WebSite. Now i have a problem testing it, It seems that My
Custom Realm is not being called. Any pointers on How to test Custom
realm.
thanx
aseem

Using fileReamd + custom realm w/ WLS6

Similar Messages

Maybe you are looking for