Using WLST to configure security in application deployments ?

Hi,
I would like to configure security (create roles and policies) in an application through WLST.
I did not manage to find what MBeans are available for this, not how to navigate to them.
Is it possible to configure security for an application (that is not in the domain or server realms, but as in the console from the security tab of a specific deployed application) through WLST ?
Thanks for your help.
Hugues

Bengt,
Configuring security policy via MBeans is not supported, console uses
internal api to achieve that. Said that, I will see if I can do anything.
Thanks,
-satya
Bengt Rodehav wrote:
We use WLST to configure our servers. Unfortunately we haven't found out how to configure a security policy via WLST.
In our case we need to define a security policy on our JMS queues. Presently we have to do this manually via the administration console. Can this be done with WLST?
Bengt Rodehav

Similar Messages

How to use wlst to configure access policies for JMS ?

Hello,
I am trying to set access policies for a JMS unified queue. It can be done easily with the console, but I could not find how to do it with wlst with version 10.0 !
I've found the following olds posts on this topic:
1. WLST Script for Protecting a JMS: WLST Script for Protecting a JMS Resource.
and
2. Create a JMX Policy by script: Create a JMX Policy by script
I could not find the "resourceId" string as stated in first link for Weblogic 8.1 SP6.
And following second link, is not working after a stop/restart of weblogic servers. :-(
Do you know a way to configure an access policy for a JMS queue with wlst tool ?
I have also tried using configToScript() command to retrieve security policy information from what has been done on the console, but I was unable to find such information ! Is security saved by configToScript() ?
Edited by: 795310 on 16 sept. 2010 08:25
Editing links.
Edited by: Fernando on 17 sept. 2010 02:20
Add configToScript information.

Security data is not persisted in config.xml so it is not contained in the output from a configToScript command.
You may want to ask in the WebLogic Server - Security forum.

Configuring the file T3 servives using WLST in WLS 10.3

Hi,
I am trying to use WLST to configure the File T3 services in Weblogic 10.3.
I can do it using the console.
Please find the link for configuring through console:
http://edocs.bea.com/wls/docs103/ConsoleHelp/taskhelp/filet3/TargetFileT3Services.html
Can some one help me in configuring it through WLST?

Hi,
did you try to record the console configuration?

Can't figure out why I can't undeploy an application using WLST

Hi,
I have WebLogic 9.2.2 installed locally on my WinXP machine. I am running a WLST script (through Ant 1.6) to attempt to undeploy my application. This line
undeploy("RoutingEngine (v1.0)")
is causing this error,
[wlst] Undeploying application RoutingEngine (v1.0) ...
[wlst] <Mar 4, 2009 1:04:40 PM MST> <Info> <J2EE Deployment SPI> <BEA-260121> <Initiating undeploy operation for application, RoutingEngine (v1.0) [archive: null], to AdminServer .>
[wlst] Failed to undeploy the application with status failed
[wlst] Current Status of your Deployment:
[wlst] Deployment command type: undeploy
[wlst] Deployment State : failed
[wlst] Deployment Message : weblogic.management.ManagementException: [Deployer:149001]No application named 'RoutingEngine (v1.0)' exists for operation undeploy
If I log in to my WebLogic admin console under "Deployments", there is an application named "RoutingEngine (v1.0)" listed. Should I be naming this something else or referencing it under another name?
Thanks, - Dave

Hi, something similar has happened in an oracle weblogic 10.3.5, when i tried to delete an application deployed as library, the adminserver responded with error “[Deployer:149001]No application named ‘my-web-9(9.2.1)’ exists for operation undeploy”.
I solved this problem, using weblogic.Deployer but specifying the appversion like this:
java weblogic.Deployer -verbose -noexit -name my-web-9 -appversion 9.2.1 -adminurl t3://192.168.40.66:7000 -user weblogic -undeploy

Configure CRS2008 to using AD and Kerberos with Java application servers.

Hi All,
I have configure CRS2008 to using AD and Kerberos with Java application servers. Domain Controller is installed on W2K3 Server. In addition, CRS2008 is installed on another W2k3 Server.
I have create service account in domain controller: CMSACC
I have create two user account: CRuser1 and CRuser2
I have create domain group: CRSGroup
After I had run the setspn in domain controller,I got the message at below:
Registered ServicePrincipalNames for CN=CMSACC, OU=TEST, DC=BD, DC=com:
    BOBJCentralMS/BDMGTSRV.BD.com
CMC Setting:
AD Administration Name: BD\administrator
Default AD Domain: BD.com
Add AD Group(Domain\Group): secWinAD:CN=CRSGroup,OU=TEST,D=BD,DC=com
Service principal name:BOBJCentralMS/CMSACCatBD.com
I have create a WINNT folder in root directory.Moreover and save bcsLognin.conf and Krb5.ini at here.
bscLogin.conf:
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
krb5.ini:
[libdefaults]
default_realm = BD.com
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
forwardable = true
BD.com = {
default_domain = BD.com
kdc = BDMGTSRV.BD.com
I have tested the Kerberos,using kinit CMSACCatBD.com password, and got error message at below:
Exception: krb_error 41 Message stream modified (41) Message stream modified
KrbException: Message stream modified (41)
        at sun.security.krb5.KrbKdcRep.check(KrbKdcRep.java:53)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:96)
        at sun.security.krb5.KrbAsRep.getReply(KrbAsRep.java:486)
     at sun.security.krb5.KrbAsRep.getReply(KrbAsRep.java:444)
     at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:310)
     at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:259)
     at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:106)
My problem is failed to logon CMC and infoview and got error message at below:
Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserNameatDNS_DomainName, and then try again.
Actually, I am sucessful to logon Business View manager with CRuser1. However, I fail to logon CMC and infoview and got the above error. Have you any suggestion to solve this problem?
Ken.

if you can logon with client tools then that should be an indication that the service account running the CMS IS working! Good news.
So the problem is likely with the java portion (krb5/bsclogin or java options)
If the files are in c:\winnt\ (if not copy them there) and perform c:\program files\business objects\javasdk\bin\kinit username
then enter and password/enter again
Probably get the same message. To note in your krb5.ini all domain info must be in CAPS (the .com appears to be in lower case)
kinit works with just the krb5.ini, java SDK and AD (removing BO config and the service account from the picture). Once that works if your java options are specified properly you should be able to login to CMC/infoview.
also 1 last point. Add udp_preference_limit = 1 to the krb5 lib defaults section
libdefaults
default_realm = BD.com
dns_lookup_kdc = true
dns_lookup_realm = true
udp_preference_limit = 1
Regards,
Tim

How to configure security policies like account locking, account expiry in portal application?

Hi All,
Can anybody pls tell me how to configure security policies like account locking,
account expiry in portal application? By default, it has a 30 minutes lock period
after 5 retries. But if I want to set other values or want to unlock account of
a user, then what to do ?
TIA,
Sudarson

I have read the SSO admin guide, and performed the steps for enabling SSL on the SSO, and followed the steps to configure mod_osso with virtual host on port 4443 as mentioned in the admin guide.
The case now is that when I call my form (which is developed by forms developer suite 10g and deployed on the forms server which is SSO enabled) , it calls the SSO module on port 7777 using http (the default behaviour).
on a URL that looks like this :
http://myhostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
and gives the error :
( Forbidden
You don't have permisission to access /sso/auth on this server at port 7777)
when I manually change the URL to :
https://myhostname:4443/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
the SSO works correctly.
The question is :
How can I change this default behaviour and make it call SSO on port 4443 using https instead ?
Any ideas ?
Thanks in advance

Applying Security policies to Web Services using WLST

Hi,
I can create security roles and assign the role expressions using WLST. I am just curious to know that if we can apply the security policies to the applications/any weblogic resource using WLST.
If yes, Can you please let me know how I can do that? I checked the Mbeans for applications and security realm, but was unable to find a way.
I am using weblogic 81 sp6 platform.
Thanks

The language used for security policies is not public in 8.1.
In 9.2, WLS supports XACML.
http://e-docs.bea.com/wls/docs92/secwlres/xacmlusing.html
<Prasanna Kulkarni> wrote in message news:[email protected]..
Hi,
I can create security roles and assign the role expressions using WLST. I am
just curious to know that if we can apply the security policies to the
applications/any weblogic resource using WLST.
If yes, Can you please let me know how I can do that? I checked the Mbeans
for applications and security realm, but was unable to find a way.
I am using weblogic 81 sp6 platform.
Thanks

Configuring Credential mapper using WLST script

Is it possible to use a wlst script to define a new credential mapper.i.e.to [perform the following steps:
Check Use cross-domain protocol.
And then fill in the the values of the attributes which follow like remote host remote user and remote password.
I tried using the wlst recording for the same.However got the following message.
A security change to a role, policy, user, group or credential mapping was made, but this change was not recorded.
I was wondering if we can access the security MBeans using WLST.
Please advise.
Thanks in advance.

It is possible if you export the properties with:
connect(url='t3://localhost:7001',adminServerName='AdminServer',timeout=60000)
serverConfig()
cd('/')
currentDomainName=cmo.getName()
cd('serverConfig:/SecurityConfiguration/' + currentDomainName + '/Realms/myrealm/CredentialMappers/DefaultCredentialMapper')
prop=Properties()
cmo.exportData('DefaultCreds','/tmp/credentialmapper_properties.txt',prop)Edit them, then import them with:
cmo.importData('DefaultCreds','/tmp/credentialmapper_properties.txt',prop)You can list the Credential Mapper configuration with:
connect(url='t3://localhost:7441',adminServerName='AdminServer',timeout=60000)
serverConfig()
cd('/')
currentDomainName=cmo.getName()
cd('serverConfig:/SecurityConfiguration/' + currentDomainName + '/Realms/myrealm/CredentialMappers/DefaultCredentialMapper')
cursor=cmo.listMappingsByPattern('*',10)
while cmo.haveCurrent(cursor):
    # A resource ID looks like: 'type=<remote>, protocol=cross-domain-protocol, remoteHost=testDomain'
    current_mapping_resource_id=cmo.getCurrentMappingResourceID(cursor)
    cmo.getRemoteUserName(current_mapping_resource_id,'cross-domain')
    cmo.advance(cursor)
cmo.close(cursor)See also: [url http://download.oracle.com/docs/cd/E12839_01/web.1111/e13707/security_data_migration.htm]Securing WebLogic Server 11g Release 1 (10.3.1) - Migrating Security Data
Edited by: Mircea Vutcovici on Jun 22, 2011 3:49 PM

How do I configure an enterprise application using Weblogic 10 wlconfig

Hi All,
I am converting an installer from WL8 to WL10. We use wlconfig to configure our EAR in wl8 with several wlconfig commands. These don't seem to work though when attempting to use wl10. The following error comes up more often than not and does not seem to be appropriate to what is actually happening.
Unable to create new bean of type WebAppComponent for pcidomain_new:Name=GenPortal,Type=Application:missing create method
I have searched the Weblogic Documentation and have found only general information on how to use wlconfig with a simple example that does not touch on application deployment. I have also found an MBean Reference but am unclear as to how to marry the two.
It would be really great if someone knew where I might find a concrete example of creating an Enterprise application using WL10.
Here is the current wlconfig task that we use successfully in weblogic 8.
${server-mbean} is read in earlier with a wlconfig query command.
          <wlconfig url="t3://${env.COMPUTERNAME}:${weblogic_port}" username="${weblogic_username}" password="${weblogic_password}">
               <create type="Application" name="GenPortal" property="GenPortalApp">
                    <set attribute="Path" value="${domain_home}/${domain_name}/applications/GenPortal.ear" />
                    <set attribute="StagingMode" value="nostage" />
                    <set attribute="TwoPhase" value="true" />
                    <create type="WebAppComponent" name="GenPortal">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="GenPortalWebApp.war" />
                    </create>
                    <create type="EJBComponent" name="GenPortalEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="GenPortalEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="BidEvaluatorEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="BidEvaluatorEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="BidFormulatorEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="BidFormulatorEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="ConfiguratorEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="ConfiguratorEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="ISOCommunicationEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="ISOCommunicationEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="LMPManagerEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="LMPManagerEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="ScriptCalcEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="ScriptCalcEJB.jar" />
                    </create>
                    <create type="EJBComponent" name="SettlementEJB">
                         <set attribute="Targets" value="${server-mbean}" />
                         <set attribute="URI" value="SettlementEJB.jar" />
                    </create>
               </create>
               <create type="StartupClass" name="PCI_Initializer">
                    <set attribute="Targets" value="${server-mbean}" />
                    <set attribute="ClassName" value="com.pci.gtdw.bean.Initialize" />
                    <set attribute="Arguments" value="port=${weblogic_port},user=background,password=${background_user_password},debug=false,loggerLevel=debug" />
               </create>
               <set mbean="${domain_name}:Name=${domain_name},Type=JTA" attribute="TimeoutSeconds" value="1200" />
          </wlconfig>
As I mentioned earlier right now this fails with when trying to create the WebAppComponent as seen in the error message above.
Thanks for any help you can provide.

Here's a couple ideas:
1. Easier, but with non-deterministic response time:   Wire the button up to one of your I/O pins and poll it. When you detect the button, issue a software call to stop the pulse train. If the duration of the button press may be short compared to your polling rate, then wire it to a counter source pin and perform edge counting. When you poll any value > 0, the press has happened. (Sometimes the value may be >1 if the switch has "bounce").
2. Trickier, but with deterministic hardware timing: Configure another counter, call it counter B, for triggered pulse generation. Wire/configure the button as the trigger. Make sure that the "high time" of the pulse is long enough to let your software respond, if needed.   Also configure your original continuous pulse train counter to use Ctr B's output as a "pause trigger", specifying to pause when high.   When the button is pressed, counter B will fire a pulse and that pulse will inhibit your original counter's pulse generation. In short, the pulses will stop until counter B's pulse has completed its full duration. Your software can monitor for this series of events and stop the original counter task if needed.
-Kevin P.

Can't fine WebServer configuration MBean using WLST

I am trying to script the various log attributes (for access.log) on the weblogic.management.configuration.WebServerMBean
using WLST. I have done the same before with wlshell. However I am having a problem
finding that mbean use the WLST directory concept. I would presume it would be
in <domain>/config/Servers/<server-name>/WebServer/<server-name>
but all that is under that dir is WebDeployment.
Can you share with me where I would find that MBean?
Also, in the above directory path example, isn't <server-name> appearing twice
a little redudant? If I have already navigated to Servers/<server-name> why should
I need to navigate thru the <server-name> again when accessing other MBean beneath
this directory?
Thanks. I really think WLST is a great tool with tons of promise. We have automated
the whole domain creation and managed server/cluster config with one script!

Darryl Stoflet wrote:
I am trying to script the various log attributes (for access.log) on the weblogic.management.configuration.WebServerMBean
using WLST. I have done the same before with wlshell. However I am having a problem
finding that mbean use the WLST directory concept. I would presume it would be
in <domain>/config/Servers/<server-name>/WebServer/<server-name>
but all that is under that dir is WebDeployment.
Can you share with me where I would find that MBean?
Also, in the above directory path example, isn't <server-name> appearing twice
a little redudant? If I have already navigated to Servers/<server-name> why should
I need to navigate thru the <server-name> again when accessing other MBean beneath
this directory?All the MBeans as you may have already noticed are arranged in a
hiearchical fashion, as you see in config.xml. So for example you have,
Domain - <domain-name>
     |_ Servers
          |_ myserver
               |_ COM
               | |_ myserver -No Contained MBeans/children
               |_ Log
               | |_ myserver - No Contained MBeans/children
               |
               |_ WebServer
                    |_ myserver
                         |_WebDeployment
                              |_ myWebDeployment
As you can see when you are at the domain level and do a ls(), by
default you will see the children MBean types under the Domain MBean
instance. If you specify ls('a'), this will show the attribute names and
values for the domain mbean instance. So, 'Servers' is a child of Domain
MBeean and when you cd to 'Servers' and do a ls() it will show the
available mbean instance names under Servers. You will cd to any
instance, in this case 'myserver'. After cd'ing to myserver when you do
a ls() you will see the child MBean types for the Server Instance and
ls('a') shows the attributes and values for the mbean instance.
Now cd to WebServer, and when you do a ls() it shows the instance names
of WebServer and since there is only one instance it shows 'myserver'
which is the name of the WebServerMBean instance. When you cd to this
instance and do a ls(), it shows the children of this mBean which is
WebDeploymentMBean.
Hope this helped explain the confusion.. :-).
Let me know if you have any questions.
Thanls,
-satya
>
Thanks. I really think WLST is a great tool with tons of promise. We have automated
the whole domain creation and managed server/cluster config with one script!

Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.

I've copied a .NET application from an older 2008 server running IIS 7.0.600.16386 to a newer 2008 R2 server running 7.5.7600.16385. The .NET framework version is 4.0.30319. I've setup an application pool and copied the wwwroot directory.
I've checked for nested web.config files and I've been reading a lot about converting the site to an application. The older server running the application is still up and running and the configurations look identical. If I convert the site to an
application the icon changes and doesn't look like it does on the old server. I'm new and still learning the basics of programming and publishing applications. Can someone point me in the right direction? I've been on google for a few days
to no avail. Thanks.
Description:
An error occurred during the processing of a configuration file required to
service this request. Please review the specific error details below and modify
your configuration file appropriately.
Parser Error Message: It
is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This error can
be caused by a virtual directory not being configured as an application in IIS.
Line 20:       <add path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" verb="*" validate="false" />
Line 21:     </httpHandlers>
Line 22:     <authentication mode="Forms">
Line 23:       <forms cookieless="UseCookies" loginUrl="~/AccessDenied.aspx" protection="All" name="TVHRFORMAUTH" timeout="180" slidingExpiration="true" />
Line 24:     </authentication>

Hi,
I agree with Tim that we can ask for better help in the following IIS forum.
IIS.NET forum
http://forums.iis.net/
Best regards,
Frank Shen

How to redeploy planning application using EPM System Configurator

Hello All
Can you please let me know how to redeploy planning application using EPM system Configurator.
I am applying a patch to ver 11.1.2.0 and i need to redeploy the planning app as one of the steps.
Thanks

Run the EPM configurator, expand planning and select "Deploy to Application Server", if it is a distributed environment and planning is not on the same server as the WebLogic admin server you will need to start the Admin Server
Cheers
John
http://john-goodwin.blogspot.com/

Updating an ALSB configuration using WLST

I've been using the AquaLogic Service Bus Deployment API (http://e-docs.bea.com/alsb/docs21/deploy/config_appx.html) to export and import an ALSB configuration from my development environment to the test environment. When the system is going to production I want the WLST-scripts to be a part of the installation scripts.
It looks like the import features of ALSB is designed to append and overwrite the imported configuration. Configuration elements that does not exist in the imported configuration will not be deleted from the target configuration. This will, over time, cause the production environment to end up as an enormous garbage can if nobody goes in and cleans it from time to time.
We have as requirements that all installation must be done automatically (untouched by humans), so my question is:
<li>How can I ensure consistency between the configuration I deliver and the production environment?
</li>
The most obvious place to look for such an opportunity should be in the import utility. But, as far as I can see, there is no <i>replace configuration</i> option available for the DeploymentMBean.
BEA develops MBeans for the most of the service components. So it should also exist MBeans that can be used to programmatically configure ALSB without using the DeploymentMBean. So, my second question is:
<li>Does anyone know of an ALSB MBean that is capable to remove a project from the configuration?</li>

Hi Helge,
There is indeed an mbean to delete projects, however this mbean and its api is not publicly supported. In other words the api may change or be removed (in favor of another one) in the next release. There are plans to expose a slight variation of this api in the next release. If you cannot wait until then you can use the non-public api with the caveat that it may change, and use it at your own risk. You may need to recompile or rewrite your source code.
The non-public api is:
ALSBConfigMBean.deleteProject(String projectName)
obtaining and using ALSBConfigMBean is similar to the usage of the public ALSBConfigurationMBean. You can obtain the name and the type of this mbean using ALSBConfigMBean.NAME|TYPE.

Configuring weblogic domain for IAM using WLST

Hi All,
i have to configure a weblogic domain using wlst(off-line).i am able to do this by using wls.jar template but that domain does not contain all the deployable component which is required for IAM ,IDM.
I don't know how to set the configuration component which is required for IAM,IDM as asked configuration wizard aske when we use GUI mode and how to give the schema details.
please give any idea how to configure a domain(for IAM,IDM) using WLST exactly same as GUI mode .
thanks

I'm not sure what is your problem, but there is no compatibility issue between CSS and Bind normally.
The docuement you referenced only says, in the background section, that the DNS server itself needs to be configured so part of your domain is handled by the CSS.
So, your dns server handles all request for your.domain but there is one NS entry forwarding request for www.your.domain to the CSS so the CSS can answer the dns request.
The css is not able to handle all types of dns request (ie: email server ip address request) so you can configure a 'dns forwarder' on the css to forward the request to another dns server.
See the following for dns forwarder config example
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a00801d3b52.shtml
Regards,
Gilles.
Thanks for rating.

How to compare the version of application deployed on wls11g using wlst

Hello
How can I find the version of the application deployed using wlst?
I tried the following script but this returns me a syntaxerror
# Script for monitoring deployed applications version #
connect('weblogic','xxxxx',url='t3://adminserver:7501')
domainConfig()
vasApps = cmo.getAppDeployments()
for app in Apps:
AppPath = '/AppDeployments/' + app.getName()
cd(AppPath)
print app.getName() + ' : source path is : ' + cmo.getAbsoluteSourcePath()
I’m trying to monitor the version of my application deployed on 4 weblogic instances
Is there any way i could accomplish this?
Thanks in advance

hello,
i managed to find out pbr, there was some tabulation missing in the script
# Script for monitoring deployed applications version #
connect('weblogic','1phinid05',url='t3://srvwls05.paryseine:7501')
domainConfig()
Apps = cmo.getAppDeployments()
for app in Apps:
AppPath = '/AppDeployments/' + app.getName()
cd(AppPath)
print app.getName() + ' : source path is : ' + cmo.getAbsoluteSourcePath()
Regards

Using WLST to configure security in application deployments ?

Similar Messages

Maybe you are looking for