Securing WebLogic Server

Managing the RDBMS Security Store

WebLogic Server provides the option of using an external RDBMS as a datastore that is used by authorization, role mapping, credential mapping, and certificate registry providers. This datastore, called the RDBMS security store, is strongly recommended for the use of SAML 2.0 services in two or more WebLogic Server instances in that domain, such as in a cluster.

The following sections explain how to configure and manage the RDBMS security store:

For the most up-to-date details about the specific database systems that are supported by WebLogic Server to function as the RDBMS security store, see Supported Configurations.

Security Providers that Use the RDBMS Security Store

The following security providers use the RDBMS security store if that store is configured in a domain:

When the RDBMS security store is configured in a domain, an instance of any of the preceding security providers that has been created in the security realm automatically uses only the RDBMS security store as a datastore, and not the embedded LDAP server. WebLogic security providers configured in the domain that are not among those in the preceding list continue to use their respective default stores; for example, the WebLogic Authentication provider continues to use the embedded LDAP server.

Oracle recommends that you configure the RDBMS security store at the time of domain creation. The Configuration Wizard has been enhanced to simplify this process. This utility includes an option for testing the RDBMS connection to help ensure that when the domain is booted, the security policies required to access the domain can be retrieved.

In addition to the Configuration Wizard, WebLogic Server also contains the RDBMSSecurityStore MBean, which is the interface for configuring the RDBMS security store via the WebLogic Scripting Tool (WLST).

Configuring the RDBMS Security Store

To create and configuring the RDBMS security store in a domain, complete the tasks described in the following sections:

Create a Domain with the RDBMS Security Store

To use the RDBMS security store in a domain, Oracle recommends that you configure the RDBMS security store at the time you create that domain. Modifying an existing domain in place to use the RDBMS security store is possible; however, it is not recommended because if the database connection is not configured correctly, the policies necessary for granting access to the domain could become unavailable, resulting in a domain that cannot be used.

WebLogic Server provides two ways to create a domain in which the RDBMS security store may be configured:

Regardless of the method you choose to create the domain, be sure to configure the connection properties for the database that serves as the RDBMS security store as explained in the following sections.

Specifying Database Connection Properties

When configuring the RDBMS security store in either the Configuration Wizard or WLST, you need to specify or configure the following:

The parameters that you specify in the JDBC driver connection properties attribute must be a comma-separated list. The following examples show the use of WLST to configure the database connection properties for Oracle, MS-SQL, and DB2.

Oracle Example

Listing 10-1 shows an example of configuring Oracle for the RDBMS security store.

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('ortiz') 
rdbms.setPasswordEncrypted('weblogic') 
rdbms.setConnectionURL('jdbc:bea:oracle://avitek21:1521') 
rdbms.setDriverName('weblogic.jdbc.oracle.OracleDriver') 
rdbms.setConnectionProperties('user=ortiz,portNumber=1521,SID=pint101a,serverName=avitek21') 

MS-SQL Example

Listing 10-2 shows an example of configuring MS-SQL for the RDBMS security store.

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('garnett') 
rdbms.setPasswordEncrypted('weblogic') 
rdbms.setConnectionURL('jdbc:bea:sqlserver://avitek6:1433') 
rdbms.setDriverName('weblogic.jdbc.sqlserver.SQLServerDriver') 
rdbms.setConnectionProperties('user=garnett,portNumber=1433,databaseName=wls3,serverName=avitek6') 

DB2 Example

Listing 10-3 shows an example of configuring DB2 for the RDBMS security store.

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('brady') 
rdbms.setPasswordEncrypted('weblogic') 
rdbms.setConnectionURL('jdbc:bea:db2://avitek3:50000') 
rdbms.setDriverName('weblogic.jdbc.db2.DB2Driver') 
rdbms.setConnectionProperties('user=brady,portNumber=50000,databaseName=wls,serverName=avitek3,batchPerformanceWorkaround=true') 

For more information about specifying connection properties for the WebLogic Type 4 JDBC driver for DB2, see “The DB2 Driver” in Type 4 JDBC Drivers.

For More Information About Default Connection Properties

Internally, the RDBMS security store uses Oracle Kodo to connect to and interoperate with the database using the WebLogic Type 4 JDBC driver for DB2. The attributes set on the RDBMSSecurityStore MBean are converted into attributes set on the properties of Kodo’s javax.sql.DataSource implementation.

For more information about these attributes, see the following topics:

Testing the Database Connection

During the process of configuring the RDBMS security store via the Configuration Wizard, you are presented with the option of testing the database connection. Oracle strongly recommends using this option because it can verify that the connection is set up properly. If there were a problem with the database connection, you might not be able subsequently to boot the domain if the security providers that control access to that domain are unable to obtain the necessary security policies.

For information about configuring the RDBMS security store via the Configuration Wizard, see “Customizing the Environment” in Creating WebLogic Domains Using the Configuration Wizard.

Create RDBMS Tables in the Security Datastore

Prior to booting the domain, the database administrator needs to run the SQL script that creates the RDBMS tables in the datastore used by the RDBMS security store. A set of SQL scripts for creating these tables for, and also removing them from, each supported RDBMS system is available in the following WebLogic Server installation directory:

WL_HOME/server/lib

When running the appropriate SQL script for the database serving as the RDBMS security store, be sure to specify the same connection properties, including the credentials of the user who has access, the database URL, etc., as specified for that RDBMS during domain creation.

Table 10-1 identifies the name of each of these SQL scripts.

Configure a JMS Topic for the RDBMS Security Store

If the RDBMS security store is configured in a domain that includes two or more WebLogic Server instances, or a cluster, Oracle strongly recommends that you also perform the following tasks:

JMS notifications enable the security data that is contained in the RDBMS security store, and that is managed by security providers in the realm, to be synchronized among all server instances in the domain.

You can enable JMS notifications by booting the domain in which the RDBMS security store has been configured, and configuring attributes on the RDBMSSecurityStore MBean via either of the following mechanisms:

The attributes of the RDBMSSecurityStore MBean that must be set to enable JMS notifications are listed and described in Table 10-2.

For more information, see the following topics:

Configuring JMS Connection Recovery in the Event of Failure

Normally, the WebLogic Security Service contained in each WebLogic Server instance in a multi-node domain connects at startup to the JMS server. If a security provider that uses the RDBMS security store makes a change to its security data, all WebLogic Server instances are notified via JMS, and the local caches used by the WebLogic Security Service in each server instance are synchronized to that change.

If the JMS connection fails in a WebLogic Server instance that has been successfully started, the WebLogic Security Service associated with that server instance starts the JMS connection recovery process. The recovery process sleeps one second between reconnect attempts. The recovery process is stopped if the JMS connection failure persists after the number of reconnect attempts with which the JMSExceptionReconnectAttempts property has been configured is reached. No further reconnect attempts are made: If a change is made to the security data in one WebLogic Server instance, the local caches managed by the WebLogic Security Service in other WebLogic Server instances are not synchronized to that change. However, if the JMS connection is successfully recovered by other means (such as a server reboot), those caches become synchronized.

If the JMS connection is not successfully started at the time a WebLogic Server instance is booted, a timer task that makes reconnect attempts is automatically started. The timer task is cancelled once the connection is successfully made. Two system properties may be configured for this timer task:

You can calculate the maximum connection polling duration by multiplying the values specified by each of the preceding system properties. For example, multiplying the default values of these two properties yields a maximum polling duration of one hour (1000 millisecond delay multiplied by 3600 reconnect attempts).

Upgrading a Domain to Use the RDBMS Security Store

To upgrade a domain to use the RDBMS security store, Oracle recommends creating a new domain in which the RDBMS security store is configured. After you create the new domain, you should export the security data from the security realm of the old domain, and import it into a security realm of the new domain. When you import security data into a security realm in a domain that uses the RDBMS security store, the data for the security providers that use the RDBMS security store is automatically loaded into that datastore. Data for security providers that do not use the RDBMS security store is automatically imported into the stores that those providers normally use by default.

It is possible to selectively migrate security providers individually from one security realm to another. However, when migrating security data to a domain that uses the RDBMS security store, Oracle recommends migrating the security realm’s data in a single operation.

For information about migrating security realms, see the following topics: