> Integrating ALES with Application Environments > Configuring the WebLogic Server 9.x SSM

Integrating ALES with Application Environments

     Previous  Next    Open TOC in new window  Open Index in new window  View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Configuring the WebLogic Server 9.x SSM

This section covers tasks that you must perform after completing the post-installation tasks for the WebLogic Server 9.x Security Service Module. The following topics are covered in this section:

 

Overview of the WebLogic Server 9.x SSM

The WebLogic Server 9.x Security Service Module integrates AquaLogic Enterprise Security with BEA WebLogic Server versions 9.1 and 9.2. It uses a different security framework from the one used in the WLS 8.1 SSM and the other ALES SSMs. When you install the WLS 9.x SSM, ALES uses the WLS 9.x security framework. As a consequence, when you use the WLS 9.x SSM, you configure security providers and other aspects of the SSM in the WebLogic Administration Console, rather than the ALES Administration Console. You still use the ALES Administration Console to configure SSMs other than the WLS 9.x SSM and to write security policies for any SSM. You must also use the ALES Administration Console to configure the ASI Authorizer and ASI Role Mapper providers.

 

Prerequisites for Configuring the WebLogic Server 9.x SSM

Before you configure a WebLogic Server 9.x SSM, you must first:

  1. Install WebLogic Server 9.x and create a WebLogic domain. See the WebLogic Server Installation Guide.
  2. Install the ALES Administration Server and the ALES policy and configuration database. See Installing the Administration Server.
  3. Install the WebLogic Server 9.x SSM. See Installing Security Service Modules.
  4. Using the ALES Administration Console, create an instance of the WebLogic Server 9.x SSM, enroll the instance, and set the password for the SSM's ASI database.

 

Configuring the WebLogic Server 9.x SSM: Main Steps

To configure the ALES WebLogic Server 9.x SSM:

  1. Copy the WLS 9.x console extension for the ALES security providers into the console-ext directory of your WebLogic Server domain. See Console Extension for Security Providers in the WLS 9.x Console.
  2. Modify the WebLogic Server startWebLogic file. See Modifying the startWebLogic File.
  3. Start WebLogic Server, using the modified startWebLogic file.
  4. Using the WebLogic Server Administration Console, create a new security realm in WebLogic Server. See Configure new security realms in the WebLogic Server Console Help.
  5. Configure security providers in the new WebLogic Server security realm. See Configuring Security Providers for the WebLogic Server 9.x SSM.
  6. Make the new security realm the active security realm for WebLogic Server. See Change the default security realm in the WebLogic Server Console Help.
  7. In the ALES Administration Console, create an SSM configuration using the same name as you used for the WLS security realm.
  8. In the ALES Administration Console, create an instance of the ASI Authorizer and ASI Role Mapper providers. Set the Identity Directory attribute of the ASI Authorizer and ASI Role Mapper to the same value in the ALES Administration Console and the WebLogic Server Administration Console.
  9. In the ALES Administration Console, create the Resource tree. See Additional Post-Installation Considerations.
  10. In the ALES Administration Console, create users, groups, attributes and policy. See Additional Post-Installation Considerations.
  11. Distribute policy and configuration. The WLS 9 SSM instance must be started after the configuration has been deployed. Policy changes can be deployed while the WLS 9 SSM instance is running.
  12. Restart the WebLogic Server instance.

 

Console Extension for Security Providers in the WLS 9.x Console

ALES includes an extension to the WebLogic Server 9.x Administration Console. If you are using the WebLogic Server 9.x SSM, you must install the console extension in order for the ALES security providers to be visible in the WebLogic Server 9.x Administration Console.

To install the ALES security provider console extension, copy ales_security_provider_ext.jar from BEA_HOME/ales22-ssm/wls9-ssm/lib to the BEA_HOME/WLS_HOME/domains/DOMAIN_NAME/console-ext directory, where DOMAIN_NAME is the name of your WebLogic Server 9.x domain.

 

Modifying the startWebLogic File

The WebLogic Server startup script does the following:

Before you can start a WebLogic Server instance that uses BEA AquaLogic Enterprise Security, you must edit the startWebLogic file. This file is located in the WebLogic Server domain directory. For example: 

BEA_HOME/user_projects/domains/mydomain

where:

See Listing 8-1 for an example of a modified startWebLogic file. To edit the startWebLogic file, do the following:

  1. Make a copy of /domains/mydomain/startWebLogic.cmd or startWebLogic.sh and name it startWeblogicALES.cmd or startWebLogicALES.sh.
  2. Make a copy of /domains/mydomain/bin/startWebLogic.cmd or startWebLogic.sh and name it startWeblogicALES.cmd or startWebLogicALES.sh.
  3. Edit /domains/mydomain/startWebLogic so that it calls /domains/mydomain/bin/startWebLogicALES rather than /domains/mydomain/bin/startWebLogic. For example:
    4. call "%DOMAIN_HOME%\bin\startWebLogicALES.cmd" %*
  4. Edit /domains/mydomain/bin/startWebLogicALES. Before the CLASSPATH is set, add a call to the set-wls-env script file in your the bin directory for your instance. The set-wls-env script sets environment variables that are used in the next steps: WLES_POST_CLASSPATH and WLES_JAVA_OPTIONS. For example:
    5. BEA_HOME/ales22-ssm/wls9-ssm/instance/wls-ssm/bin/set-wls-env.sh
    Where:

    ales22-ssm is the directory where you installed the Security Service Module.

    instance is the directory where all instances are stored.

    wls-ssm is the name of the Security Service Module instance you created earlier.

    For example, if you created a WLS SSM instance called myInstance, the call looks like this:

    On Windows: 

    call "C:\bea\ales22-ssm\wls9-ssm\instance\myInstance\bin\set-wls-env.bat"

    On UNIX: 

    . "/bea/ales22-ssm/wls9-ssm/instance/myInstance/bin/set-wls-env.sh"
  5. Append the following to the CLASSPATH:

    6. On Windows: 

    %WLES_POST_CLASSPATH%

    On UNIX: 

    ${WLES_POST_CLASSPATH}
  6. On Windows, add quotes to %JAVA_HOME%\bin\java in the weblogic.Server command.
    7. "%JAVA_HOME%\bin\java"
  7. Add the following to the command that starts the server application:

    8. On Windows: 

    %WLES_JAVA_OPTIONS%

    On UNIX: 

    ${WLES_JAVA_OPTIONS}
    Listing 8-1 Modified startWebLogic File 
    ...

    . /BEA_HOME/ales22-ssm/wls9-ssm/instance/myInstance/bin/set-wls-env.sh
    ...
    if [ "${WLS_PW}" != "" ] ; then
            JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.management.password=${WLS_PW}"
    fi

    CLASSPATH="${CLASSPATH}${CLASSPATHSEP}${MEDREC_WEBLOGIC_CLASSPATH}    ${WLES_POST_CLASSPATH}"

    echo "."

    if [ "${WLS_REDIRECT_LOG}" = "" ] ; then
            echo "Starting WLS with line:"
            echo "${JAVA_HOME}/bin/java ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS}      ${WLES_JAVA_OPTIONS} -Dweblogic.Name=${SERVER_NAME} -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy  ${PROXY_SETTINGS} ${SERVER_CLASS}"

            ${JAVA_HOME}/bin/java ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS}     ${WLES_JAVA_OPTIONS} -Dweblogic.Name=${SERVER_NAME} -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy ${PROXY_SETTINGS} ${SERVER_CLASS} 

    else

            echo "Redirecting output from WLS window to ${WLS_REDIRECT_LOG}"
            ${JAVA_HOME}/bin/java ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS}     ${WLES_JAVA_OPTIONS} -Dweblogic.Name=${SERVER_NAME} -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy ${PROXY_SETTINGS} ${SERVER_CLASS} >"${WLS_REDIRECT_LOG}" 2>&1
    fi

 

Configuring Security Providers for the WebLogic Server 9.x SSM

The WebLogic Server 9.x security framework includes a full set of security providers that are available out of the box. The WLS 9.x security providers are described in the WLS documentation, in the following chapters of Securing WebLogic Server:

In addition, you can use the following ALES security providers by adding them to your WebLogic Server security realm:

Note: While you can use the WebLogic Server Administration Console to add these ALES security providers to a WebLogic Server security realm and to configure those security providers, the WLS console does not provide online help for the ALES security providers.

See the following topics in this section for detailed information about configuring the WebLogic 9.x SSM:

 

Configuring a WLS 9.x Security Realm for ALES

When you configure a WebLogic 9.x security realm for ALES, you must include at a minimum the following ALES security providers:

Using the WebLogic Server Console to Configure Security Providers

To configure security providers for the WebLogic Server 9.x Security Service Module, you use the WebLogic Server Administration Console, not the ALES Administration Console. In order to create and configure ALES security provider instances using the WebLogic Server Administration Console, you must first install an extension to the console. See Console Extension for Security Providers in the WLS 9.x Console.

To configure security providers for ALES and WebLogic Server 9.x:

  1. Start the WebLogic Server instance and log into the WebLogic Server Administration Console. The default URL for the console is http://localhost:7001/console .
  2. In the Change Center in the upper left corner, click Lock & Edit.
  3. In the left panel of the WebLogic Server Administration Console, under Domain Structure, select Security Realms.
  4. On the Summary of Security Realms page, click New to create a new security realm. Create a new realm using a name that matches the configuration ID you used when you created the WebLogic Server 9.x SSM instance. For the purposes of this procedure, we will assume that the new security realm is named mywls9ssm.
  5. On the Summary of Security Realms page, select the mywls9ssm security realm.
  6. On the Configuration: General page:
    1. Set Security Model Default to Advanced.
    2. Uncheck Combined Role Mapping Enabled.
    3. Click Save.
    4. If Check Role and Policies is not visible, click Advanced.
    5. Set Check Role and Policies to All Web applications and EJBs.
    6. Click Save.
  7. Select the Providers tab. You will configure new authentication, authorization, adjudication, role mapping, and auditing providers for the mywls9ssm security realm.
  8. On the Providers: Authentication page, configure a new Database Authenticator security provider. To do this:
    1. Click New.
    2. Give the new Database Authenticator a name, such as ALESDatabaseAuthenticator.
    3. Select Database Authenticator as the Type.
    4. Click OK.
    5. Select the new Database Authenticator. On its Configuration: Common page, set the Control Flag to REQUIRED and click Save.
    6. On the new Database Authenticator's Configuration: Provider Specific page, set the database login, password, JDBC class name and driver. Click Save.
  9. Select the Providers: Authorization page and configure a new ASI Authorization provider:
    1. Click New.
    2. Give the new ASI Authorization provider a name, such as ASIAuthorizationProvider.
    3. Select ASIAuthorizationProvider as the Type.
    4. On the new ASI Authorization provider's Configuration: Provider Specific page, set Identity Directory and Application Deployment Parent. Click Save.
  10. Select the Providers: Adjudication page and configure a new ASI Adjudication provider:
    1. Click Replace.
    2. Give the new ASI Adjudication provider a name, such as ASIAdjudicator.
    3. Select ASIAdjudicator as the Type.
    4. On the ASIAdjudicator's Configuration: Provider Specific page, uncheck Require Unanimous Permit and click Save.
  11. Select the Providers: Role Mapping page and configure a new ASI Role Mapper provider:
    1. Click New.
    2. Give the new ASI Role Mapper provider a name, such as ASIRoleMapperProvider.
    3. Select ASIRoleMapperProvider as the Type.
    4. On the new ASI Role Mapper provider's Configuration: Provider Specific page, set Identity Directory and Application Deployment Parent. Click Save.
  12. Select the Providers: Auditing page and configure a new Log4j Auditing provider:
    1. Click New.
    2. Give the new Log4j Auditing provider a name, such as Log4jAuditor.
    3. Select Log4jAuditor as the Type.
  13. Select the Providers: Credential Mapping page and configure a new Credential Mapping provider:
    1. Click New.
    2. Give the new Credential Mapping provider a name, such as DefaultCredentialMapper.
    3. Select DefaultCredentialMapper as the Type.
  14. Select the Providers: Certification Path page and configure a Certification Path provider:
    1. Click New.
    2. Click Next.
    3. Click Next.
    4. Check Replace Existing Builder.
    5. Click Finish.
  15. Change the default (active) security realm to your newly configured security realm. By default, a realm named myrealm is the active security realm when you install a WebLogic Server instance. To change the default security realm:
    1. In the left pane of the WebLogic Server Administration Console, select your domain to open the Settings page for the domain.
    2. On the Settings page for the domain, expand Security > General.
    3. Select your new security realm, mywls9ssm, as the default security realm and click Save.
      4. Note: If you create a new security realm but do not configure the required security providers, the new realm will not be available in the pull-down menu.
  16. In the Change Center in the upper left corner, click Activate Changes.

Using the ALES Administration Console to Configure Security Providers

After you have configured security providers for the WebLogic Server 9.x Security Service Module using the WebLogic Server Administration Console, you need to make some configuration changes in the ALES Administration Console also. You need to configure the ASI Authorization and ASI Role Mapping providers and create required users and policy for the WebLogic Server 9.x SSM to start.

To configure security providers in the ALES Administration Console:

  1. Log into the ALES Administration Console. The default URL for the console is https://localhost:7010/asi.
  2. Create an SSM configuration using the same name as you used for the WebLogic Server security realm. The default used previously was mywls9ssm.
  3. Create an instance of the ASI Authorizer and ASI Role Mapper providers. Set the Identity Directory attribute of the ASI Authorizer and ASI Role Mapper to the same value in the ALES Administration Console and the WebLogic Server Administration Console.
  4. Create the Resource tree. For information about how to do this, see Additional Post-Installation Considerations.
  5. Create users, groups, attributes and policy. For information about how to do this, see Additional Post-Installation Considerations.
  6. Distribute policy and configuration.
Note: The WebLogic Server instance must be started after the configuration has been deployed. Other policy changes can be deployed while the WebLogic Server instance is running.

  Back to Top       Previous  Next