What? WebLogic not portable?

Question

WebLogic does not implement the standard methods in the Servlet 2.0 API
which allow access to the Client's Certificate. It is up to the Servlet
Runner to set attributes in the Servlet Request Object and make them
available to the Servlet programmer. The attribute
javax.servlet.request.X509Certificate
can be set to retrieve information on the certificate of the client.
WebLogic does not set
this attribute. In fact, the following methods return null in WebLogic:
getAuthType();
getUserPrincipal()
req.getAttribute("javax.servlet.request.X509Certificate")
WebLogic uses its own proprietary API to retrieve client certificates in
Two-Way-Authentication (otherwise known as Client Authentication). In
order to get access to the Client's Certificate you must import
weblogic.security.X509; (this is really bad) and make a call to
request.getAttribute("javax.net.ssl.peer_certificates"), which returns
an array of weblogic.security.X509 objects. Sure there are ways around
the import, such as dynamic class loading and etc., but I shouldn't have
to do this!
Importing weblogic.security.X509 is bad because I cannot port this code
to another Servlet engine and have it work seamlessly :-(((. I'm pretty
sure that WebLogic would not pass the certification for a certified J2EE
container with a servlet engine that performs like this.
-Tim Kimmet ([email protected])

Answer 1

Deepa,
WebLogic won't start when there is a problem with a security provider. If the SiteMinder plugin is not configured properly, you'll have to figure out what it takes to appease SiteMinder.
In other words, the problem is with your SiteMinder setup, not WebLogic. That means that the plugin is misconfigured or perhaps the Policy Server is. I don't have any specific advice since I'm unfamiliar with SiteMinder.
Mike
Weblogic/J2EE Security Blog: http://monduke.com