Weblogic API for modifying users/roles

Question

I need to write an application which will enable adding users to weblogic
domain and configuring roles.
Does Weblogic provide such API?
If so, what are the relevant packages?
P.S.
I wasn't sure which exact newsgroup my question belongs to.
If anyone has a better suggestions please provide it.

Answer 1

I searched the newsgroup and found that somebody addressed this issue.
"Andrey" <[email protected]> wrote in message
news:[email protected]...
>
WebLogic 7.0
I have read a number of questions on how to do these but not many answers,so
after figuring it all out, I thought I would post a message describing allthese
tasts (It would be great if BEA would start something like 'HOW-TOs forLinux'
for WebLogic)
-1. Imports required :
import weblogic.jndi.Environment;
import weblogic.management.MBeanHome;
import weblogic.management.WebLogicObjectName;
import weblogic.management.configuration.DomainMBean;
import weblogic.management.configuration.SecurityConfigurationMBean;
import weblogic.management.security.RealmMBean;
importweblogic.management.security.authentication.AuthenticationProviderMBean;
import weblogic.management.security.authentication.GroupEditorMBean;
import weblogic.management.security.authentication.UserEditorMBean;
importweblogic.management.security.authentication.UserPasswordEditorMBean;
import weblogic.security.providers.authentication.*;
0. Code to retrieve DefaultAuthenticatorMBean (this code is running insideWebLogic
server - I have it inside EJB):
DefaultAuthenticatorMBean authBean;
Context ctx = new InitialContext();
MBeanHome mbeanHome = (MBeanHome)ctx.lookup(MBeanHome.ADMIN_JNDI_NAME);
>
//Find UserEditorMBean
DomainMBean dmb = mbeanHome.getActiveDomain();
SecurityConfigurationMBean scmb =dmb.getSecurityConfiguration();
RealmMBean rmb = scmb.findDefaultRealm();
AuthenticationProviderMBean[] providers =rmb.getAuthenticationProviders();
>
for (int i = 0; i < providers.length; i++) {
if (providers[i] instanceof DefaultAuthenticatorMBean) {
authBean = (DefaultAuthenticatorMBean) providers;
break;
1. Create/Drop/Update users
to perform these tasks, the user must be logged in into weblogic and be in
Administrators
group. Then, the code is as follows:
create user: authBean.createUser(username, password, description);
remove user: authBean.removeUser(username);
change user's description: authBean.setUserDescription(username,newDescription);
>
remove user from group: authBean.removeMemberFromGroup(groupname,username);
>
add user to group: authBean.addMemberToGroup(groupname,username);
>
2. Change other users' passwords (MUST BE ADMIN TO DO THIS - by Admin Imean be
a member of Administrators group)
authBean.resetUserPassword(username, newPassword);
3. Change your own password:
this is a bit trickier, because if you are not an admin, you can't changeyour
own password!!!! This is a part that I personally don't understand - seemslike
a screw up on BEA's part. So, to allow users to change their ownpasswords, you
must change security context in the middle of processing to that of Adminuser
and run this function as Admin user. Although a bit ackward, it's veryeasy to
do. Suppose you have two EJBs - EJB A and EJB B. EJB A does normalprocessing
for the user and always runs in logged in user's security context. Now,suppose
you want to add a method to EJB A to change current password. The methodmay
look like:
public void changePassword(String logon, String oldpwd, String newpwd)
throws some exceptions
Now, there is no way to do it in EJB A, because for most users, it willrun in
a 'non-admin' security context. So, to get around it, you create another
EJB - EJB B. This EJB has one method:
public void changePassword(String logon, String oldpwd, String newpwd)
throws some exceptions
and one major difference - this EJB always runs in a secrity context ofadmin
user. To get an EJB B running 'as admin user', all you have to do in EJBA is
the following
EJB A:
public void changePassword(String logon, String oldpwd, String newpwd)
Hashtable props = new Hashtable();
props.put(Context.SECURITY_PRINCIPAL, "wlmanager");
props.put(Context.SECURITY_CREDENTIALS, "password");
// get context that with different credentials
Context ctx = new InitialContext(props);
EJBBHome home = (EJBBHome) ctx.lookup("EJBBHome");
EJBBLocal adminEJB = home.create();
adminEJB.changePassword(logon, oldpwd, newpwd);
adminEJB.remove();
of course, this poses a problem of hardcoding user id and password foradmin user
in your application - you can come up with your own ways to secure that.
THAT's IT!!! You can use the method explained in part 3 to allownon-admin users
to do pretty much everything, however for the sake of security, I woulddefinetly
vote against it and use part 3 to ONLY allow users change their ownpasswords
>
Enjoy
Andrey
"Yonatan Taub" <[email protected]> wrote in message
news:[email protected]...
I need to write an application which will enable adding users to weblogic
domain and configuring roles.
Does Weblogic provide such API?
If so, what are the relevant packages?
P.S.
I wasn't sure which exact newsgroup my question belongs to.
If anyone has a better suggestions please provide it.