> Samples Tutorial > Managing Data Service Security

Samples Tutorial

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Managing Data Service Security

The Data Services Platform (ALDSP) leverages the security features of the underlying WebLogic platform. Specifically, it uses resource authorization to control access to ALDSP resources based on user identity or other information.

Note: WebLogic Server must be running.

 

Objectives

After completing this lesson, you will be able to:

 

Overview

ALDSP's security infrastructure extends WebLogic Server's security policies to include ALDSP objects such as data sources and stored queries, as well as security roles, groups, and users. These security policies allow ALDSP administrators to set up rules that dynamically determine whether a given user:

By default data services do not have any security policies configured. Therefore data is generally accessible unless a more restrictive policy for the information is configured. Security policies can apply at various levels of granularity, including:

Implementing ALDSP access control involves using the WebLogic Server Console to configure user groups and roles. You can then use the ALDSP Console to create policies for ALDSP, including data services and their functions.

 

16.1 Creating New User Accounts

The first step in creating data service security policies is to create user accounts and either assign the user account to a default group or configure a new group. There are 12 default authenticator groups.

Objectives

In this exercise, you will:

Instructions

  1. Open the WebLogic Server Console (http://localhost:7001/console/), using the following credentials:
  1. Choose Security Arrow symbol Realms Arrow symbol myrealm Arrow symbol Users.
    2. Figure 16-1 User Security


    User Security

  2. Select Configure New User.
    3. Figure 16-2 Define User in Security Realm


    Define User in Security Realm

  3. Create a new user account by completing the following steps:
    1. Enter Joe in the Name field.
    2. Enter password in the Password field.
    3. Enter password in the Confirm Password field.
    4. Click Apply.
  4. Repeat step 3 and step 4, entering Bob in the Name field (step 4a).
  5. (Optional) Choose Security Arrow symbol Realms Arrow symbol myrealm Arrow symbol Users to view the results.
    6. Figure 16-3 New Users Added


    New Users Added

 

16.2 Setting Application-Level Security

Application-level security applies to all data services within the deployed ALDSP domain, regardless of user permission or group. By default, when you turn on access control for an application, access to any of its resources is blocked, except for users who comply with policies configured for the resources.

Alternatively, by allowing default anonymous access, you can grant access to its resources by default. You can enable default anonymous access level by navigating to Application level General tab under Access Control (application Name Arrow symbol General). In this case, a resource is restricted only if a more specific security policy for it exists; for example, a security policy at the data service function level.

Objectives

In this exercise, you will:

Instructions

  1. In the ALDSP Console (http://localhost:7001/ldconsole/), using the + icon, expand the ldplatform directory.
    2. Note: If you click the ldplatform name, the Application List page opens. You do not want this page for this lesson.
  2. Click Evaluation. The application's General page opens.
  3. Select Check Access Control.
  4. Click Apply.
    5. Figure 16-4 Set General Security


    Set General Security

  5. Test the security policy by completing the following steps:
    1. In WebLogic Workshop, open CustomerProfile.ds in Test View.
    2. Select getCustomerProfile() from the Function drop-down list.
    3. Enter CUSTOMER3 in the Parameters field.
    4. Click Execute. The test should return an Access Denied error. With the current security settings, no one can access the application's functions. You must grant user access to read and write functions.
      5. Figure 16-5 Access Denied


      Access Denied

 

16.3 Granting User Access to Read Functions

ALDSP security policies can be set at the function level, which applies to specific functions within specific data services. Function-level security can be read and/or write permissions. A policy may include any number of restrictions; for example, limiting access based on the role of the user or on the time of access. Specifically, policies can be based on the following criteria:

Objectives

In this exercise, you will:

Instructions

  1. In the ALDSP Console, open the CustomerProfile data service. (The data service is located in ldplatform\Evaluation\DataServices\CustomerManagement.)
  2. Click the Security tab. The Security Policy tab opens.
    3. Figure 16-6 Data Service-Level Security Policy


    Data Service-Level Security Policy

  3. Click the Action Policy icon for the getCustomerProfile resource to open the Access Control Policy window.
    4. Figure 16-7 Configure Security


    Configure Security

  4. Set read access for a specific user, by completing the following steps:
    1. Select User name of the caller.
    2. Click Add. The Users dialog box opens.
    3. Enter Joe in the Name field.
    4. Click Add.
      5. Figure 16-8 Adding User


      Adding User

    5. Click OK and move back to the Access Control Policy window.
    6. Click Apply.
  5. Login to the now-secure application, by completing the following steps:
    1. In WebLogic Workshop, choose Tools Arrow symbol Application Properties Arrow symbol WebLogic Server.
    2. Select Use Credentials Below.
    3. Enter Joe and password in the Use Credentials Below fields.
    4. Click OK.
      5. Figure 16-9 Logging Into Secure Application


      Logging Into Secure Application

  6. Test the security policy by completing the following steps:
    1. Open CustomerProfile.ds in Test View.
    2. Select getCustomerProfile() from the Function drop-down list.
    3. Enter CUSTOMER3 in the Parameters field.
    4. Click Execute. The test should permit access and return the requested data.
    5. Click Edit, modify an item, and then click Submit. An error message will display because Joe is granted only read access.

 

16.4 Granting User Access to Write Functions

As noted in the previous exercise, security policies at the function level can allow either read and/or write permissions.

Objectives

In this exercise, you will:

Instructions

  1. In the ALDSP Console, open the CustomerProfile data service.
  2. Select the Security tab. The Security Policy tab opens.
  3. Click the Action Policy icon for the submit resource. The Access Control Policy window opens.
  4. Set write access to a user, by completing the following steps:
    1. Select User name of the caller.
    2. Click Add.
    3. Enter Joe in the Name field.
    4. Click Add.
    5. Click OK.
    6. Click Apply.
  5. Test the security policy, by completing the following steps:
    1. In WebLogic Workshop, open CustomerProfile.ds in Test View. The file is located in DataServices\CustomerManagement.
    2. Select getCustomerProfile() from the Function drop-down list.
    3. Enter CUSTOMER3 in the Parameters field.
    4. Click Execute. The test should permit access and return the specified results.
    5. Click Edit. Because Joe is granted both read and write access, you can now edit the results.

 

16.5 Setting Element-Level Data Security

A policy can apply to individual items of information within a return type, such as a salary node in a customer object. If blocked by insufficient credentials at this level, the rest of the returned information is provided without the blocked element.

Objectives

In this exercise, you will:

Instructions

  1. In the ALDSP Console, open the CustomerProfile data service.
  2. Select the Security tab.
  3. Set element-level security, by completing the following steps:
    1. Select the Secured Elements tab.
    2. Expand the CustomerProfile and customer+ nodes.
    3. Select the checkbox for the ssn simple element.
    4. Expand the orders ? and orders * nodes.
    5. Select the checkbox for the order_line * complex element.
    6. Click Apply.
      7. Figure 16-10 Setting Element-Level Security


      Setting Element-Level Security

  4. Return to the Security Policy tab for CustomerProfile. You should see two new resources: CustomerProfile/customer/ssn and CustomerProfile/customer/orders/order/order_line.
    5. Figure 16-11 New Secured Element Resources


    New Secured Element Resources

  5. Set the security policy for the complex order_line element, by completing the following steps:
    1. Return to the Security Policy tab for CustomerProfile.
    2. Click the Action Policy icon for the CustomerProfile/customer/orders/order/order_line resource. The Access Control Policy window opens.
    3. Select User name of the caller.
    4. Click Add.
    5. Enter Joe in the Name field.
    6. Click Add.
    7. Click OK.
    8. Click Apply.
  6. Set the security policy for the simple ssn element, by completing the following steps:
    1. Click the Action Policy icon for the CustomerProfile/customer/ssn resource. The Access Control Policy window opens.
    2. Select User name of the caller.
    3. Click Add.
    4. Enter Bob in the Name field.
    5. Click Add.
    6. Click OK.
    7. Click Apply.

 

16.6 Testing Element-Level Security

At this point, element-level security policies are defined for both Bob and Joe. Testing the policy within WebLogic Workshop lets you determine what data results these two users will be able to access.

Objectives

In this exercise, you will:

Instructions

  1. Test element-level security for Joe, by completing the following steps:
    1. In WebLogic Workshop, open CustomerProfile.ds in Test View.
    2. Select getCustomerProfile() from the Function drop-down list.
    3. Enter CUSTOMER3 in the Parameters field.
    4. Click Execute. The test should permit access and return all results except SSN.
    5. Click Edit, modify an order_line value, click Submit, and click OK. The specified change is submitted.
    6. Click Execute to refresh the data set.
    7. Verify that changes have been saved.
  2. Test the element-level security policy for Bob, by completing the following steps:
    1. Choose Tools Arrow symbol Application Properties Arrow symbol WebLogic Server.
    2. Select Use Credentials Below.
    3. Enter Bob and password in the Use Credentials Below fields.
    4. Click OK.
    5. Open CustomerProfile.ds in Test View.
    6. Select getCustomerProfile(CustomerID) from the Function drop-down list.
    7. Enter CUSTOMER3 in the Parameters field.
    8. Click Execute. The test should fail. Although Bob can access the SSN element, he does not have read access to the getCustomerProfile() function.
  3. Change the security policy for Bob, by completing the following steps:
    1. In the ALDSP Console, open the CustomerProfile data service.
    2. Select the Security tab.
    3. Click the Action Policy icon for the getCustomerProfile resource. The Access Control Policy window opens.
    4. Set read access for Bob, by completing the following steps:

      5. - Select the caller's User name.Click Add.

      - Enter Bob in the Name field. Click Add, then Ok.

      - Click the "and User name of the caller" line, located in the Policy Statement section of the window.

      - Click Change, which changes the line to an "or User name of the caller" condition.

      - Click Apply.

      Figure 16-12 Enabling read Access for Two Users


      Enabling read Access for Two Users

  4. In WebLogic Workshop, test the getCustomerProfile() function again. This time, user Bob can view all elements except order_line information.
  5. Try modifying data by clicking on Edit button and changing SSN. Submit changes by clicking on Submit button. An error message will display because Bob does not have write privileges.
  6. Reset the application-level security, by completing the following steps:
    1. Reset the WebLogic Workshop Arrow symbol Tools Arrow symbol Application Properties Arrow symbol WebLogic Server authentication options back to user: weblogic, password: weblogic.
    2. In the ALDSP Console (http://localhost:7001/ldconsole/), using the + icon, expand the ldplatform directory.
      3. Note: If you click the ldplatform name, the Application List page opens. You do not need this page for this lesson.
    3. Click Evaluation. The Administration Control's General page opens.
    4. Clear Check Access Control.
    5. Click Apply.

 

Lesson Summary

In this lesson, you learned how to:


  Back to Top       Previous  Next