Programming WebLogic Security

 

 

Introduction to WebLogic Security

WebLogic Security Features

WebLogic Security Architecture

Connections with Web Browsers

Connections with Servlets, JSPs, EJBs, RMI Objects and Java Applications

Connections with Administration Servers

Using WebLogic Server as a Client to BEA Tuxedo

 

Security Fundamentals

Resources

Security Realms

Users

Groups

ACLs and Permissions

SSL Protocol

Authentication Mechanisms

Digital Certificates

Certificate Authority

Supported Public Key Algorithms

Supported Symmetric Key Algorithms

Supported Message Digest Algorithms

Supported Cipher Suites

 

Securing a WebLogic Server Deployment

Why Is Security Important for WebLogic Server?

Determine the Security Needs of Your WebLogic Server Deployment

Secure the Machine on Which WebLogic Server Runs

Accessing Protected Ports on UNIX

Design Network Connections Carefully

Manage the WebLogic Server Development and Production Environments

Use Encryption

Use the SSL Protocol

Prevent Man-in-the-Middle Attacks

Prevent Denial of Service Attacks

Secure the HTTP Response Header

Protect User Accounts

Protect Application Content

Replace HTML Special Characters in User-Supplied Data

Use Protected EJBs to Limit Access to Business Logic

Use ACLs

Use the Appropriate Security Realm

Secure Your Database

Use Auditing

Control Access to Multiple Domains

 

Programming with the WebLogic Security SPI

Before You Begin

WebLogic Security SPI

Using JAAS Authentication

Using JNDI Authentication

Communicating Securely with SSL-Enabled Web Browsers

Using Mutual Authentication

Mutual Authentication with JNDI

Mapping a Digital Certificate to a WebLogic Server User

Using Mutual Authentication with Other WebLogic Servers

Using Mutual Authentication with Servlets

Using a Custom Host Name Verifier

Using a Trust Manager

Using an SSL Context

Using Custom ACLs

Writing a Custom Security Realm

Define a Class for Users

Define a Class for Groups

Define Enumeration Classes for Users and Groups

Define a Class for the Custom Security Realm

Using Authorization in a Custom Security Realm

Auditing Security Events

Filtering Network Connections

Using RMI over IIOP over SSL