Securing WebLogic Server 12c

Securing WebLogic Server 12c

by Luca Masini, Rinaldi Vincenzo
Released November 2012
Publisher(s): Packt Publishing
ISBN: 9781849687782

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Learn to develop, administer and troubleshoot for WebLogic Server

  • Discover Authentication providers
  • Configure security for WebLogic applications and develop your own security providers
  • Step by step guide to administer and configure WebLogic security providers
  • Quick guide to security configuration in WebLogic realm

In Detail

Security is a must in modern Enterprise architecture, and WebLogic implements a very complete and complex architecture for configuration and implementation, and we need to deeply know in technologies, terminology and how the security process works between all actors. Transparent security of your applications and Weblogic infrastructure need a good knowledge of the issues you can incur in this long and error prone configuration process.

"Securing WebLogic Server 12c" will simplify a complex world like WebLogic Security, helping the reader to implement and configure. It’s the only fast guide that will let you develop and deploy in a production system with best practices both from the development world and the operation world.

This book will try to make a clear picture of Java EE Security with clean and simple step-by-step examples that will guide the reader to security implementation and configuration

From the concepts of Java EE Security to the development of secure application, from the configuration of a realm to the setup of Kerberos Single Sign on, every concept is expressed in simple terms and surrounded by examples and pictures. Finally, also a way to develop WebLogic Security Providers with Maven, so that you can add the security part of your infrastructure to your enterprise best practices.

Table of contents

  1. Securing WebLogic Server 12c
    1. Table of Contents
    2. Securing WebLogic Server 12c
    3. Credits
    4. About the Authors
    5. About the Reviewers
    6. www.PacktPub.com
      1. Support files, eBooks, discount offers and more
        1. Why Subscribe?
        2. Free Access for Packt account holders
        3. Instant Updates on New Packt Books
    7. Preface
      1. What this book covers
      2. What you need for this book
      3. Who this book is for
      4. Conventions
      5. Reader feedback
      6. Customer support
        1. Downloading the example code
        2. Errata
        3. Piracy
        4. Questions
    8. 1. WebLogic Security Concepts
      1. General concept of security in Java EE
        1. WebLogic security architecture
        2. Identifying – Subjects, Principals, and Credentials
        3. WebLogic resources
        4. Writing custom providers – MBeans
      2. Authentication Providers
        1. Authentication under WebLogic
        2. MBean and JAAS
        3. Multipart Authentication Provider
        4. Perimeter Authentication
      3. Identity Assertion
      4. Credential Mapper
      5. JASPIC and Java EE
      6. JACC
      7. Summary
    9. 2. WebLogic Security Realm
      1. Configuration of local LDAP server: user/roles/lockout
        1. Users and groups
          1. Users section
          2. Groups section
        2. Security role condition
          1. Basic
          2. Date and time-based
          3. Context element
          4. User lockout
          5. Unlocking user
      2. Configuring an external LDAP for Authentication/Authorization
        1. Configuring a new provider
        2. Control Flag
        3. Active Directory provider-specific configuration
          1. Connection
          2. Users
          3. Groups
          4. Static groups
          5. General
        4. Performance options
          1. Principal Validator Cache
        5. Troubleshooting problems
          1. User lockout in an Active Directory context
      3. Using Identity Assertion
      4. Summary
    10. 3. Java EE Security with WebLogic
      1. Setting up an Enterprise Maven project
        1. Creating the modules with maven-archetype-plugin
        2. Installing the WebLogic Server and the WebLogic Maven plugin
          1. Configuring wls-maven-plugin into the EAR POM
        3. Split deploy and beabuild-maven-plugin
        4. Launching our Hello Maven and WebLogic world application
      2. Securing the web module
        1. Standard DD mapping
        2. Custom Roles Mapping
        3. Programmatic security
        4. Programmatic security with WebLogic XACML provider
      3. A RESTful and secure EJB component
        1. Bean packaged into the WAR module
        2. Changing Security Identity with RunAs
        3. Securing the EJB module
      4. Summary
    11. 4. Creating Custom Authentication Providers with Maven
      1. The Maven project
        1. Creating the Maven project
        2. Dependencies
        3. Reconfiguring standard plugins
        4. Adding WebLogic MBeanMaker to the POM
        5. Defining the MBean with an MDF File
      2. Writing the MBean implementation
        1. Initializing the provider
        2. Implementation of the provider
      3. Custom JAAS LoginModule
        1. The login() method
        2. Lifecycle methods – commit(), abort(), and logout()
        3. A simple SSO JSP
        4. Running the provider
      4. Summary
    12. 5. Integrating with Kerberos SPNEGO Identity Assertion
      1. Using Identity Assertion SSO Kerberos in a Microsoft domain
        1. Windows client needs to be in the Active Directory domain
        2. Windows client session needs to be logged in the Active Directory domain
        3. Integrated Windows Authentication
        4. DNS URL entry configuration and SPN definition
        5. Technical Active Directory user
        6. Keytab generation and the krb5 config file
        7. JAAS file creation
        8. WLS init startup arguments configuration
      2. SPNEGO Identity asserter configuration
        1. Debugging issues
      3. Summary
    13. Index

Product information

  • Title: Securing WebLogic Server 12c
  • Author(s): Luca Masini, Rinaldi Vincenzo
  • Release date: November 2012
  • Publisher(s): Packt Publishing
  • ISBN: 9781849687782