Security Management

Security Providers in WebLogic

The authenticated and authorized information in SIP Servlet Engine is passed to WebLogic Server by using the security providers in WebLogic. For more information about the WebLogic security architecture, see WebLogic Security Service Architecture.

The following describes the security providers provided by SIP Servlet Engine.

Authentication provider

SipAuthenticator

The authentication provider used when authenticating the SIP request. It is invoked from the Authentication Manager and checks that the user who sent an SIP message is a user registered in SIP Servlet Engine.

FormAuthenticator

The authentication provider used when performing the FORM authentication via Web. It checks and authenticates that the user name sent via FORM authentication is a user registered in SIP Servlet Engine.

DefaultAuthenticator

The default authentication provider provided by WebLogic. It is used for managed user authentication used in Administration Console, etc.

Authorization provider

DefaultAuthorizer

The default authorization provider provided by WebLogic. It grants permission to users authenticated by the authentication provider to access the WebLogic resource.

Roll Mapping Provider

SipRoleMapper

The role mapping provider which maps the role to the SIP request. It grants the role assigned by Authorization Manager on SIP Servlet Engine to the user who sent the SIP message.

DefaultRoleMapper

The default role mapping provider provided by WebLogic.

Also, in order to authenticate the SIP message, the LoginConfig with the following settings is specified for "java.security.auth.login.config" system property.

equips-sip {
   com.oki.sip.bea.wls81.security.authentication.EngineLoginModule required debug=true;
};

This LoginModule is invoked from the Authentication Manager of SIP servlet engine and specifies user information and role information to Subject, using the SPI.

Data Structure

The database used by SIP Servlet Engine contains the user information and the role information assigned to the user.

The following shows the basic data structure.

Data structure about the user information

In addition, each table contains the hash value used by the digest authentication, the number of times the user authentication failed, and so on. These data are used by Authentication Manager when authenticating the user.

Data structure about the role information

Data structure about the role assigned to the user

These data about the role are used by Authorization Manager when granting the role to the authenticated user.

To manipulate these data, use the SIP Servlet Engine management tool. (See sip-admin Users Guide.)

APIs for Managing the Roles

The component for managing the roles is deployed as EJB. You can use the RoleMapper interface to add or remove the role and add or remove the user to/from the role.

The following shows the APIs for managing the roles.

• RoleMapper Interface
• RoleMapInfo Class

RoleMapper Interface

The interface for managing the roles.

public interface RoleMapper extends EJBObject {

    boolean isUserInRole(SipURI subscriber, String role) throws RemoteException;

    void addRole(String role, String desc) throws RemoteException;

    void removeRole(String role) throws RemoteException;

    Set getAllRoles() throws RemoteException;

    void addMemberToRole(SipURI subscriber, String role) throws RemoteException;

    void removeMemberFromRole(SipURI subscriber, String role) throws RemoteException;

    Set getMembersRole(SipURI subscriber) throws RemoteException;
}

isUserInRole is the method to determine whether the user is included in the role or not. The argument subscriber specifies the SipURI of the target user and the argument role specifies the role name to determine. If the subscriber is included in the role, this method returns true. Otherwise, it returns false.

addRole is the method to add the new role. The argument role specifies the name of the role to add and the argument desc specifies the description of the role.

removeRole is the method to remove the role. The argument role specifies the name of the role to remove.

getAllRoles is the method to get the Set which contains the information of all the roles. The returned Set includes the RoleMapInfo.

addMemberToRle is the method to add the user to the role. The argument subscriber specifies the SipURI of the target user and the argument role specifies the role name.

removeMemberFromRole is the method to remove the user from the role. The argument subscriber specifies the SipURI of the target user and the argument role specifies the role name.

getMembersRole is the method to get the Set which contains the information of the role which includes the user. The argument subscriber specifies the SipURI of the target user.

RoleMapInfo Class

The class for containing the information about the roles.

public class RoleMapInfo implements Serializable {

    public RoleMapInfo(String rolename,
		       String desc);

    public String getRoleName();

    public String getDesc();

    public int hashCode();

    public boolean equals(Object obj);

    public String toString();

}

The argument rolename specifies the name of the role for the role information and the argument desc specifies the description for the role information.

getRoleName can get the name of the role for the role information.

getDesc can get the description for the role information.

Limitations on Using

There are two ways to use the user information managed by the existing application:

1. Copy the existing user information to the database schema managed by SIP Servlet Engine 3.0.
2. Change the implementation of the SPI by adding the SIP information managed by SIP Servlet Engine 3.0 to the existing user information.

Each has its advantages and disadvantages:

Last Modified:Tue Dec 28 15:19:23 JST 2004