Use this tab to configure a Role Mapping provider for a security realm. Role Mapping providers support security policies (dynamic role associations) by obtaining a computed set of roles granted to a requestor for a given resource. Role Mapping providers supply Authorization providers with this role information so that the Authorization Provider can answer the "is access allowed?" question for resources that use role-based security (that is, Web application and Enterprise JavaBean container resources).

The WebLogic Security Framework will use business logic and the current operation parameters (obtained from the J2EE and WebLogic deployment descriptor files) to determine which roles (if any) apply to the particular Subject at the moment in which access is required for a given resource. If multiple Role Mapping providers are configured, the set of roles returned by all Role Mapping providers will be intersected by the WebLogic Security Framework.

By default, the WebLogic Role Mapping provider is configured in myrealm. You can use a Custom Role Mapping provider instead of the WebLogic Role Mapping provider. For a Custom Role Mapping provider to appear on the Role Mapper tab, the MBean JAR file for the provider must be in the WL_HOME\lib\mbeantypes directory.

A Role Mapping provider that supports deploying roles on behalf of Web application or Enterprise JavaBean (EJB) deployments needs to implement the DeployableRoleProvider Security Service Provider Interface (SSPI) instead of the RoleProvider SSPI. You also need to enable the Role Deployment Enabled attribute on this tab. The Role Deployment Enabled attribute is enabled by default for the WebLogic Role Mapping provider.

During application deployment, WebLogic Server reads role mappings from the weblogic.xml and weblogic-ejb-jar.xml files. This information is used to populate the WebLogic Role Mapping provider. Any changes made to the role mappings through the WebLogic Server Administration Console are not persisted to the weblogic.xml and weblogic-ejb-jar.xml files. Before you deploy the application again (which will happen if you redeploy it through the WebLogic Server Administration Console, modify it on disk, or restart WebLogic Server), you need enable the Ignore Security Data in Deployment Descriptors attribute on the General tab for the security realm.

Attribute Label	Description	Value Constraints
Name	The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration. Attribute: Name	Configurable: yes Readable: yes Writable: yes
Description	A short description of the WebLogic Role Mapping provider. Attribute: Description	Default: "Weblogic Default Role Mapper Provider" Readable: yes
Version	The version number of the WebLogic Role Mapping provider. Attribute: Version	Default: "1.0" Readable: yes
Role Deployment Enabled	Indicates whether this Role Mapping provider stores roles that are created while deploying a Web application or EJB. Attribute: RoleDeploymentEnabled	Default: true Readable: yes

Attribute Label

Description

Value Constraints

Name

The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration.

Attribute: Name

Configurable: yes

Readable: yes

Writable: yes

Description

A short description of the WebLogic Role Mapping provider.

Attribute: Description

Default: "Weblogic Default Role Mapper Provider"

Readable: yes

Version

The version number of the WebLogic Role Mapping provider.

Attribute: Version

Default: "1.0"

Readable: yes

Role Deployment Enabled

Indicates whether this Role Mapping provider stores roles that are created while deploying a Web application or EJB.

Attribute: RoleDeploymentEnabled

Default: true

Readable: yes