Developing Security Providers for WebLogic Server

Introduction to Developing Security Providers for WebLogic Server

Audience for This Guide

Prerequisites for This Guide

Overview of the Development Process

Designing the Custom Security Provider

Creating Runtime Classes for the Custom Security Provider by Implementing SSPIs

Generating an MBean Type to Configure and Manage the Custom Security Provider

Writing Console Extensions

Configuring the Custom Security Provider

Providing Management Mechanisms for Security Policies, Security Roles, and Credential Maps

Design Considerations

General Architecture of a Security Provider

Security Services Provider Interfaces (SSPIs)

Understand an Important Restriction

Understand the Purpose of the "Provider" SSPIs

Determine Which "Provider" Interface You Will Implement

The DeployableAuthorizationProvider SSPI

The DeployableRoleProvider SSPI

The DeployableCredentialProvider SSPI

Understand the SSPI Hierarchy and Determine Whether You Will Create One or Two Runtime Classes

SSPI Quick Reference

Security Service Provider Interface (SSPI) MBeans

Understand Why You Need an MBean Type

Determine Which SSPI MBeans to Extend and Implement

Understand the Basic Elements of an MBean Definition File (MDF)

Custom Providers and Classpaths

Specifying Non-Clear Text Values for MBean Attributes

Understand the SSPI MBean Hierarchy and How It Affects the Administration Console

Understand What the WebLogic MBeanMaker Provides

About the MBean Information File

SSPI MBean Quick Reference

Security Data Migration

Migration Concepts

Formats

Constraints

Migration Files

Adding Migration Support to Your Custom Security Providers

Administration Console Support for Security Data Migration

Management Utilities Available to Developers of Security Providers

Security Providers and WebLogic Resources

The Architecture of WebLogic Resources

Types of WebLogic Resources

WebLogic Resource Identifiers

The toString() Method

Resource IDs and the getID() Method

Creating Default Groups for WebLogic Resources

Creating Default Security Roles for WebLogic Resources

Creating Default Security Policies for WebLogic Resources

Looking Up WebLogic Resources in a Security Provider's Runtime Class

Single-Parent Resource Hierarchies

Pattern Matching for URL Resources

ContextHandlers and WebLogic Resources

Initialization of the Security Provider Database

Best Practice: Create a Simple Database If None Exists

Best Practice: Configure an Existing Database

Best Practice: Delegate Database Initialization

Authentication Providers

Authentication Concepts

Users and Groups, Principals and Subjects

LoginModules

The LoginModule Interface

LoginModules and Multipart Authentication

Java Authentication and Authorization Service (JAAS)

How JAAS Works With the WebLogic Security Framework

Example: Standalone T3 Application

The Authentication Process

Do You Need to Develop a Custom Authentication Provider?

How to Develop a Custom Authentication Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthenticationProvider SSPI

Implement the JAAS LoginModule Interface

Throwing Custom Exceptions from LoginModules

Example: Creating the Runtime Classes for the Sample Authentication Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Authentication Provider Using the Administration Console

Managing User Lockouts

Specifying the Order of Authentication Providers

Identity Assertion Providers

Identity Assertion Concepts

Identity Assertion Providers and LoginModules

Identity Assertion and Tokens

How to Create New Token Types

How to Make New Token Types Available for Identity Assertion Provider Configurations

Passing Tokens for Perimeter Authentication

Common Secure Interoperability Version 2 (CSIv2)

The Identity Assertion Process

Do You Need to Develop a Custom Identity Assertion Provider?

How to Develop a Custom Identity Assertion Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthenticationProvider SSPI

Implement the IdentityAsserter SSPI

Example: Creating the Runtime Class for the Sample Identity Assertion Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Identity Assertion Provider Using the Administration Console

Principal Validation Providers

Principal Validation Concepts

Principal Validation and Principal Types

How Principal Validation Providers Differ From Other Types of Security Providers

Security Exceptions Resulting from Invalid Principals

The Principal Validation Process

Do You Need to Develop a Custom Principal Validation Provider?

How to Use the WebLogic Principal Validation Provider

How to Develop a Custom Principal Validation Provider

Implement the PrincipalValidator SSPI

Authorization Providers

Authorization Concepts

Access Decisions

The Authorization Process

Do You Need to Develop a Custom Authorization Provider?

How to Develop a Custom Authorization Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthorizationProvider SSPI

Implement the DeployableAuthorizationProvider SSPI

Implement the AccessDecision SSPI

Example: Creating the Runtime Class for the Sample Authorization Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Authorization Provider Using the Administration Console

Managing Authorization Providers and Deployment Descriptors

Enabling Security Policy Deployment

Provide a Mechanism for Security Policy Management

Option 1: Create Your Own "Policy Editor" Page Using Console Extensions

Option 2: Develop a Stand-Alone Tool for Security Policy Management

Option 3: Integrate an Existing Security Policy Management Tool into the Administration Console

Adjudication Providers

The Adjudication Process

Do You Need to Develop a Custom Adjudication Provider?

How to Develop a Custom Adjudication Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AdjudicationProvider SSPI

Implement the Adjudicator SSPI

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Adjudication Provider Using the Administration Console

Role Mapping Providers

Role Mapping Concepts

Security Roles

Dynamic Security Role Computation

The Role Mapping Process

Do You Need to Develop a Custom Role Mapping Provider?

How to Develop a Custom Role Mapping Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the RoleProvider SSPI

Implement the DeployableRoleProvider SSPI

Implement the RoleMapper SSPI

Implement the SecurityRole Interface

Example: Creating the Runtime Class for the Sample Role Mapping Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Role Mapping Provider Using the Administration Console

Managing Role Mapping Providers and Deployment Descriptors

Enabling Security Role Deployment

Provide a Mechanism for Security Role Management

Option 1: Create Your Own "Role Editor" Page Using Console Extensions

Option 2: Develop a Stand-Alone Tool for Security Role Management

Option 3: Integrate an Existing Security Role Management Tool into the Administration Console

Auditing Providers

Auditing Concepts

Audit Channels

Auditing Events From Custom Security Providers

The Auditing Process

Do You Need to Develop a Custom Auditing Provider?

How to Develop a Custom Auditing Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuditProvider SSPI

Implement the AuditChannel SSPI

Example: Creating the Runtime Class for the Sample Auditing Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Auditing Provider Using the Administration Console

Configuring Audit Severity

Credential Mapping Providers

Credential Mapping Concepts

The Credential Mapping Process

Do You Need to Develop a Custom Credential Mapping Provider?

How to Develop a Custom Credential Mapping Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the CredentialProvider SSPI

Implement the DeployableCredentialProvider SSPI

Implement the CredentialMapper SSPI

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Credential Mapping Provider Using the Administration Console

Managing Credential Mapping Providers, Resource Adapters, and Deployment Descriptors

Enabling Deployable Credential Mappings

Provide a Mechanism for Credential Map Management

Option 1: Create Your Own "Credential Mappings" Page Using Console Extensions

Option 2: Develop a Stand-Alone Tool for Credential Map Management

Option 3: Integrate an Existing Credential Map Management Tool into the Administration Console

Auditing Events From Custom Security Providers

Security Services and the Auditor Service

How to Audit From a Custom Security Provider

Create an Audit Event

Implement the AuditEvent SSPI

Implement an Audit Event Convenience Interface

Audit Severity

Audit Context

Example: Implementation of the AuditRoleEvent Interface

Obtain and Use the Auditor Service to Write Audit Events

Example: Obtaining and Using the Auditor Service to Write Role Audit Events

Writing Console Extensions for Custom Security Providers

When Should I Write a Console Extension?

When In the Development Process Should I Write a Console Extension?

How Writing a Console Extension for a Custom Security Provider Differs From a Basic Console Extension

Main Steps for Writing an Administration Console Extension

Replacing Custom Security Provider-Related Administration Console Dialog Screens Using the SecurityExtensionV2 Interface