> Avitek Medical Records Development Tutorials > Moving to Production

Avitek Medical Records Development Tutorials

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

 

Moving to Production

 

Tutorial 16: Creating Users, Groups, and Global Security Roles

This tutorial describes how to create the users, groups, and global security roles that are required by the MedRec application.

After you finish this tutorial, you will be able to log in to all three MedRec Web applications as the appropriate type of user (administrator, patient, or physician) and start using the application.

The tutorial includes:

 

Prerequisites

Before starting this tutorial:

 

Procedure

To create the required users, groups, and security roles using the Administration Console:

Step 1: Specify security realm settings.

  1. With MedRecServer running, open the Administration Console by navigating in a browser to:
    2. http://host:7101/console

    where host refers to the computer on which MedRecServer is running. If your browser is on the same computer as MedRecServer, you can use the URL http://localhost:7101/console.

  2. Specify weblogic for both the username and password and click Log In.
  3. If you have not already done so, click Lock & Edit, located in the upper left Change Center window of the Administration Console.
  4. In the middle left-hand pane called Domain Structure, click MedRecDomainArrow symbolSecurity Realms.
  5. In the Realms table in the right pane, click myrealm.
  6. Select the ConfigurationArrow symbolGeneral tab.
  7. Click the Advanced link.
  8. From the Check Roles and Policies drop-down menu, select All Web Applications and EJBs.

    9. This setting means that the WebLogic Security Service will perform security checks on all URL (Web) and EJB resources. For more information, see Understanding How to Check Security Roles and Security Policies in Securing WebLogic Resources.

  9. In the When Deploying Web Applications or EJBs drop-down menu, select Ignore Roles and Policies From DD.

    10. This setting indicates that you will set security for Web Application and EJB resources in the Administration Console, not in deployment descriptors. For more information, see Understanding the On Future Redeploys Setting in Securing WebLogic Resources.

  10. Click Save.
  11. In the Change Center, click Activate Changes to update the MedRec server configuration.
  12. Restart MedRecServer. (See Starting and Stopping Servers: Quick Reference in Managing Server Startup and Shutdown.)

Step 2: Create groups.

  1. In the left Domain Structure pane of the Administration Console, click MedRecDomainArrow symbolSecurity Realms.
  2. In the Realms table in the right pane, click myrealm.
  3. Select the Users and GroupsArrow symbolGroups tab.

    4. The Groups table displays all groups currently defined in the WebLogic Authentication provider's database.

  4. Click New.
  5. In the Name field, enter MedRecAdmins.
  6. In the Description field, enter MedRecAdmins can log on to the MedRec Administrators Web site.
  7. In the Provider drop-down list, select DefaultAuthenticator (default value).
  8. Click OK.
  9. Repeat steps 4 - 8 to create a group named MedRecPatients, with a description of MedRecPatients can log on to the MedRec Patients Web site, and DefaultAuthenticator provider.
  10. Repeat steps 4- 8 to create a group named MedRecPhysicians, with a description of MedRecPhysicians can log on to the MedRec Physician Web site, and DefaultAuthenticator provider.
  11. In the Groups table, confirm that the three groups have been added.

Step 3: Create users and add the users to groups.

  1. In the left Domain Structure pane of the Administration Console, click MedRecDomainArrow symbolSecurity Realms.
  2. In the Realms table in the right pane, click myrealm.
  3. Select the Users and GroupsArrow symbolUsers tab.

    4. The Users table displays all users currently defined in the WebLogic Authentication provider’s database.

  4. Click New.
  5. In the Name field, enter admin@avitek.com.
  6. In the Description field, enter MedRec administrator.
  7. In the Provider drop-down list, select DefaultAuthenticator (default value).
  8. In the Password and Confirm Password fields, enter weblogic.
  9. Click OK to save your changes.
  10. In the Users table, click admin@avitek.com.
  11. Select the Groups tab.
  12. In the Available choice box, highlight the MedRecAdmins group.
  13. Click the highlighted arrow to move the MedRecAdmins group from the Available to the Chosen choice box.
  14. Click Save.
  15. Repeat steps 1 - 14 to create a user named mary@md.com, a MedRec physician who also uses the weblogic password and the DefaultAuthenticator provider, and belongs in the MedRecPhysicians group.
  16. Repeat steps 1 - 14 to create a user named larry@bball.com, a MedRec patient who also uses the weblogic password and the DefaultAuthenticator provider, and belongs in the MedRecPatients group.
  17. Repeat steps 1 - 14 to create a user named medrec_webservice_user, a MedRec Web Service User who also uses the weblogic password and the DefaultAuthenticator provider, and belongs in the MedRecPhysicians group.
  18. Repeat steps 1 - 3 to navigate to the Users table of the myrealm security realm to confirm that the three users have been added.

Step 4: Create global roles and grant the global roles to the groups.

  1. In the left Domain Structure pane of the Administration Console, click MedRecDomainArrow symbolSecurity Realms.
  2. In the Realms table in the right pane, click myrealm.
  3. Select the Roles and PoliciesArrow symbolRealm Roles tab.

    4. The Roles table displays all global and scoped roles currently defined in the WebLogic Role Mapping provider's database.

  4. In the Roles table, expand Global Roles and click Roles.

    5. The Global Roles table displays all global roles currently defined in the WebLogic Role Mapping provider's database.

  5. Click New.
  6. In the Name field, enter MedRecAdmin.

    7. Leave the Provider Name field to the default value: XACMLRoleMapper.

  7. Click OK.
  8. In the Global Roles table, click MedRecAdmin.
  9. In the Global Role Conditions page, click Add Conditions.
  10. In the Choose a Predicate page, select Group for the Predicate List.
  11. Click Next.
  12. In the Group Argument Name field, enter MedRecAdmins.
  13. Click Add.
  14. Click Finish.

    15. The Role Conditions table includes the following entry: 

    Group MedRecAdmins
  15. Click Save.
  16. Repeat steps 1 - 15 to create a global role named MedRecPatient and to grant this global role to the MedRecPatients group.
  17. Repeat steps 1 - 15 to create a global role named MedRecPhysician and to grant this global role to the MedRecPhysicians group.
  18. Repeat steps 1 - 4 to view the Global Roles table and confirm that the three new global roles have been added.

Step 5: Log in to and use the MedRec applications.

Now that you have created all the required users, groups, and roles, you can actually log in to the various MedRec Web applications and start using them. First navigate to the following start page in a browser: 

http://host:7101/start.jsp

In the preceding URL, host refers to the computer that hosts MedRecServer. If your browser is on the same computer as MedRecServer, you can use localhost; for example: http://localhost:7101/start.jsp.

The main MedRec application page appears. Click on the links to log in in to the different Web applications, using the following username/passwords:

 

Best Practices

 

The Big Picture

The MedRec application has been coded such that only certain roles are allowed to access certain modules, in particular login to Web Applications such as patient, physician, and admin. This tutorial showed you first how to create groups to represent patients, administrators, and physicians, then how to create individual users and assign them to a particular group, and finally, how to map a group to a role. Once this security configuration is in place, you can log in to the applications using the appropriate user.

You might have noticed, however, that in Step 3: Create users and add the users to groups., you did not create an actual patient user. This is because patients, along with their personal information, are stored in the PointBase database and are authenticated using a Custom DBMS Authenticator. The database also stores the group to which the user is assigned. You must, however, use the Administration Console to create the MedRecPatients group and the MedRecPatient role, and then map the group to the role.

The next tutorials show how to secure specific resources, such as Web applications and EJBs.

 

Related Reading


  Back to Top       Previous  Next