Introduction to WebLogic Enterprise Security
|
 |
 |
|
|
 |
 |
This section describes the general architecture of the BEA WebLogic Enterprise Security services, providers and service modules. Each Security Service Module you purchase is shipped with a set of security providers. Although applications can leverage the services offered through the existing security providers, the flexible infrastructure also allows security vendors, integrators, and customers to write their own security providers. The BEA WebLogic Enterprise Security providers and third-party security providers can be mixed and matched to create unique security solutions, allowing organizations to take advantage of new technology advances in some areas while retaining proven methods in others. The Administration Application allows you to configure and manage all your security providers and service modules through one unified management console.
The architecture comprises the following major components, discussed in the following sections:
BEA WebLogic Enterprise Security lets you control all of your security policies and configuration data from a single console. The Administration Application gives you the enterprise-wide visibility you need to analyze security policies and ensure that applications and resources are properly protected. BEA WebLogic Enterprise Security also lets you delegate security administration to remote administrators who often better understand local users and business needs and who are better positioned to manage the security policies. By combining centralized control with delegated administration, you can define and manage overall policies while specifying the management responsibilities to be handled by organizational administrators. For additional information on the Administration Application features, see Security Administration. The Administration Server consists of several components (as shown in Figure 2-1), including:
Policy Distributor-Ensures that the correct policies are provided to the correct Security Service Modules and maintains policy synchronization.
Policy Database-Maintains security policy data managed by the Administration Application in a relational database. The database management system provides the authoritative source of configuration and policy. Data from the policy database is distributed to the Security Service Modules by the Policy Distributor.
Policy Importer-Imports policy data from an external file, generated in another system, exported from another instance of an Administrative Application, or manually coded. For additional information on how to use the Policy Loader, see the Policy Managers Guide.
Administrative Console-Supports administrative policy security and administration delegation through a web browser-based user interface. Security configuration, policy configuration, user attributes (if required), resources, and rules are all managed through the console.
Administration Logic-Maintains the Policy Database used by both the Administration Console and the Policy Loader.
Metadirectory-Application security policies frequently need more information than simple identity data to resolve sophisticated policy decisions. BEA WebLogic Enterprise Security provides a metadirectory that accesses and synchronizes user attributes from a variety of sources to support these policies. These attributes are typically not be stored in any single place. The metadirectory assembles attributes for each user and caches them for use by Security Service Modules. For additional information on metadirectories, see User Directories. BEA WebLogic Enterprise Security products can access user directories from a variety of sources, including: application databases, Lightweight Directory Access Protocol (LDAP) directory servers, network databases, and others.
Figure 2-1 Administration Server Architecture
BEA WebLogic Enterprise Security employs a fully-distributed security enforcement architecture consisting of Security Service Modules embedded in applications, application servers, and web servers throughout an enterprise (see Figure 2-2). To facilitate the management of a potentially large number of distributed Security Service Modules, the Administration Application uses a remote administration mechanism to distribute appropriate configuration and policy data to each Security Service Module.
The Service Control Module (SCM) is an essential component of this remote administration mechanism. Each Service Control Module is responsible for storing and maintaining the configuration data for all Security Service Modules running its machine. Once started, a Security Service Module receives its configuration data from the local Service Control Module. When a change is made and distributed from the Administration Application, the Service Control Manager receives the change and updates the cached copy of the configuration. On restart, the Security Service Module receives updated configuration data from the Service Control Manager. Policy data does not require a restart, but is applied based on the desired provisioning characteristics.
In addition to facilitating management, the Service Control Manager enables Security Service Modules to operate in the absence of the Administration Application. Because the Service Control Manager maintains a persistent copy of each configuration, new Security Service Modules can be started and existing Security Service Modules continue to function, even if the Administration Application goes down or is intentionally unavailable, such as in occasionally connected computing environments.
Figure 2-2 Service Control Manager
BEA WebLogic Enterprise Security supports a variety of Security Service Modules that you integrate with the security framework and provision as needed. The primary function of the security framework is to provide a simple application programming interface (API) that can be used by security and application developers to define security services. For a complete discussion of BEA WebLogic Enterprise Security services, see Security Services. You may incorporate as many Security Service Modules as you need to secure the enterprise, and configure and manage them directly through a central Administration Application as shown in Figure 2-2. The distributed nature of the architecture allows you to configure, manage and distribute policy throughout the enterprise.
Configuration data for each Security Service Module is maintained within each machine and handled by a Service Control Manager. One additional benefit of this architecture is that even if the administration server goes down (either for maintenance or due to failure), there is no impact on the applications or security services provided by those Security Service Modules. At this time, the following Security Service Modules are available:
The WebLogic Server 8.1 Security Service Module is a security enhancement product that supports BEA WebLogic Server, Version 8.1. Further, the Security Service Module ties the application server into the Administration Application so that all application server administrative security activities are performed through the Administration Application. The application server with the Security Service Module add-on supports enterprise-level security by making security for WebLogic Server host applications an integral part of the enterprise policy. All WebLogic Server security-related functions remain available, but those functions are provided through the Security Service Module. Figure 2-3 shows the major components of the WebLogic Server 8.1 Security Service Module.
Figure 2-3 WebLogic Server 8.1 Security Service Module Architecture
The ProductName Security Service Module (SSM) provides an environmental binding between the WebLogic Enterprise Security infrastructure and IIS and Apache web servers. The SSM consists of three components, a Web Server Environmental Binding, an Internal Web Services Client, and the Web Services SSM (which includes the Security Service APIs, Security Framework and security providers) (See Figure 2-4). The WebLogic Enterprise Security infrastructure provides six distinct services: Registry, Authentication, Authorization, Auditing, Role Mapping, and Credential Mapping. Each of these services is expressed in a way that is understandable to applications running within a web server that is protected by the WebLogic Enterprise Security infrastructure. Therefore, the SSM can be used to configured and enforce security for web server applications and resources.
The Web Server SSM makes access control decisions for the web server to which it is bound. The security configuration on which the access control decisions are based is defined and deployed by the Administration Server via the Security Control Module.
You can tailor the Web Server SSM to meet your specific needs. Using templates provided as part of the product, security developers can customize the look and feel of authentication pages and configure parameters that allow fine tuning for a particular installation. Web applications can have information added to the HTTP request by the security framework, such as roles and response attributes. Additionally, the Web Server SSM enables security administrators and web developers to perform security tasks for applications running on a web server.
Figure 2-4 Web Server SSM Components
The Web Services Security Service Module (SSM) provides provides six security service APIs: Registry, Authentication, Authorization, Auditing, Role Mapping, and Credential Mapping (see Figure 2-5). These APIs can be used to developed web services clients to access the WebLogic Enterprise Security infrastructure and use it to make access control decisions for users attempting to access web server application resources. Once the web services client is implemented, it uses the Web Services SSM (which incorporates the Security Services APIs, the Security Framework, and the configured security providers) to make access control decisions for the web server to which it is connected. You use the WebLogic Enterprise Security Administration Application to configured and deploy a security configuration to protect the web server application resources. Thus, the Web Services SSM enables security administrators and web developers to perform security tasks for applications running on a web server. Additionally, you can use the Web Services SSM to add information provided by the Security Framework (such as roles and response attributes) to the HTTP requests handled by the protected web server applications.
Figure 2-5 shows the components of the Web Services SSM. These components are the same as corresponding components in the Web Server SSM.
Figure 2-5 Web Services SSM Components
The Java Security Service Module provides an application programming interface (API) that allows security developers to insert security into their applications. These interfaces support the most commonly required security functions and are organized into services that are logically grouped by functionality.
After you use the Java Security Service Module interfaces to implement security functions in your Java application, you can deploy and run your application on any instance of a Java Security Service Module that supports the configuration requirements of your application. The Java Security Service Module offers five security services: Authentication Service, Authorization Service, Auditing Service, Role Service, and Credential Mapping Service. The name of each service indicates a type of function that can be implemented within a Java application. Each of these services is discussed in Security Services. Figure 2-6 shows the major components of the Java Security Service Module. The Java Security Service Module comprises the security service APIs, the security framework, and the security providers that you configure.
Figure 2-6 Java Security Service Module Architecture
|
|
|
