Developing Security Providers for WebLogic Server

Download Docs

Site Map

Glossary

e-docs > WebLogic Server > Developing Security Providers for WebLogic Server

Introduction to Developing Security Providers for WebLogic Server

Audience for This Guide

Security Providers and the WebLogic Security Framework

Types of Security Providers

Authentication Providers

Identity Assertion Providers

Principal Validation Providers

Authorization Providers

Adjudication Providers

Role Mapping Providers

Auditing Providers

Credential Mapping Providers

Security Provider Summary

Security Providers and Security Realms

Terminology

Design Considerations

Overview of the Development Process

Designing the Custom Security Provider

Creating Runtime Classes for the Custom Security Provider by Implementing SSPIs

Generating an MBean Type to Configure and Manage the Custom Security Provider

Writing Console Extensions

Configuring the Custom Security Provider

General Architecture of a Security Provider

Security Services Provider Interfaces (SSPIs)

Understand the Purpose of the "Provider" SSPIs

Determine Which "Provider" Interface You Will Implement

The DeployableAuthorizationProvider SSPI

The DeployableRoleProvider SSPI

The DeployableCredentialProvider SSPI

Understand the SSPI Hierarchy and Determine Whether You Will Create One or Two Runtime Classes

SSPI Quick Reference

Security Service Provider Interface (SSPI) MBeans

Understand Why You Need an MBean Type

Determine Which SSPI MBeans to Extend and Implement

Understand the Basic Elements of an MBean Definition File (MDF)

Understand the SSPI MBean Hierarchy and How It Affects the Administration Console

Understand What the WebLogic MBeanMaker Provides

SSPI MBean Quick Reference

Initializing the Security Provider Database

What Is a Security Provider Database?

Security Realms and Security Provider Databases

Best Practice: Create a Simple Database If None Exists

Best Practice: Configure an Existing Database

Best Practice: Delegate Database Initialization

Authentication Providers

Authentication Concepts

Users and Groups, Principals and Subjects

LoginModules

The LoginModule Interface

LoginModules and Multipart Authentication

Java Authentication and Authorization Service (JAAS)

How JAAS Works With the WebLogic Security Framework

Example: Standalone T3 Application

The Authentication Process

Do You Need to Develop a Custom Authentication Provider?

How to Develop a Custom Authentication Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthenticationProvider SSPI

Implement the JAAS LoginModule Interface

Example: Creating the Runtime Classes for the Sample Authentication Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Authentication Provider Using the Administration Console

Managing User Lockouts

Identity Assertion Providers

Identity Assertion Concepts

Identity Assertion Providers and LoginModules

Identity Assertion and Tokens

How to Create New Token Types

How to Make New Token Types Available for Identity Assertion Provider Configurations

Passing Tokens for Perimeter Authentication

Common Secure Interoperability Version 2 (CSIv2)

The Identity Assertion Process

Do You Need to Develop a Custom Identity Assertion Provider?

How to Develop a Custom Identity Assertion Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthenticationProvider SSPI

Implement the IdentityAsserter SSPI

Example: Creating the Runtime Class for the Sample Identity Assertion Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Identity Assertion Provider Using the Administration Console

Principal Validation Providers

Principal Validation Concepts

Principal Validation and Principal Types

How Principal Validation Providers Differ From Other Types of Security Providers

Security Exceptions Resulting from Invalid Principals

The Principal Validation Process

Do You Need to Develop a Custom Principal Validation Provider?

How to Develop a Custom Principal Validation Provider

Implement the PrincipalValidator SSPI

Authorization Providers

Authorization Concepts

WebLogic Resources

The Architecture of WebLogic Resources

Types of WebLogic Resources

WebLogic Resource Identifiers

How Security Providers Use WebLogic Resources

Single-Parent Resource Hierarchies

WebLogic Resources, Roles, and Security Policies

Access Decisions

The Authorization Process

Do You Need to Develop a Custom Authorization Provider?

How to Develop a Custom Authorization Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuthorizationProvider SSPI

Implement the DeployableAuthorizationProvider SSPI

Implement the AccessDecision SSPI

Example: Creating the Runtime Class for the Sample Authorization Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Authorization Provider Using the Administration Console

Managing Authorization Providers and Deployment Descriptors

Enabling Security Policy Deployment

Adjudication Providers

The Adjudication Process

Do You Need to Develop a Custom Adjudication Provider?

How to Develop a Custom Adjudication Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AdjudicationProvider SSPI

Implement the Adjudicator SSPI

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Adjudication Provider Using the Administration Console

Setting the Require Unanimous Permit Attribute

Role Mapping Providers

Role Mapping Concepts

Roles

Role Definitions

Roles and WebLogic Resources

Dynamic Role Association

The Role Mapping Process

Do You Need to Develop a Custom Role Mapping Provider?

How to Develop a Custom Role Mapping Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the RoleProvider SSPI

Implement the DeployableRoleProvider SSPI

Implement the RoleMapper SSPI

Example: Creating the Runtime Class for the Sample Role Mapping Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Role Mapping Provider Using the Administration Console

Managing Role Mapping Providers and Deployment Descriptors

Enabling Security Role Deployment

Auditing Providers

Auditing Concepts

How Auditing Providers Work With the WebLogic Security Framework and Other Types of Security Providers

Audit Channels

Do You Need to Develop a Custom Auditing Provider?

How to Develop a Custom Auditing Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the AuditProvider SSPI

Implement the AuditChannel SSPI

Example: Creating the Runtime Class for the Sample Auditing Provider

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Auditing Provider Using the Administration Console

Configuring Audit Severity

Credential Mapping Providers

Credential Mapping Concepts

The Credential Mapping Process

Do You Need to Develop a Custom Credential Mapping Provider?

How to Develop a Custom Credential Mapping Provider

Create Runtime Classes Using the Appropriate SSPIs

Implement the CredentialProvider SSPI

Implement the DeployableCredentialProvider SSPI

Implement the CredentialMapper SSPI

Generate an MBean Type Using the WebLogic MBeanMaker

Create an MBean Definition File (MDF)

Use the WebLogic MBeanMaker to Generate the MBean Type

Use the WebLogic MBeanMaker to Create the MBean JAR File (MJF)

Install the MBean Type Into the WebLogic Server Environment

Configure the Custom Credential Mapping Provider Using the Administration Console

Managing Credential Mapping Providers, Resource Adapters, and Deployment Descriptors

Enabling Deployable Credential Mappings

Auditing Events From Custom Security Providers

Security Services and the Auditor Service

How to Audit From a Custom Security Provider

Create an Audit Event

Implement the AuditEvent SSPI

Implement an Audit Event Convenience Interface

Audit Severity

Audit Context

Example: Implementation of the AuditAtnEvent Interface

Obtain and Use the Auditor Service to Write Audit Events

Example: Obtaining and Using the Auditor Service to Write Authentication Audit Events

Writing Console Extensions for Custom Security Providers

When Should I Write a Console Extension?

When In the Development Process Should I Write a Console Extension?

How Writing a Console Extension for a Custom Security Provider Differs From a Basic Console Extension

Main Steps for Writing an Administration Console Extension

Replacing Custom Security Provider-Related Administration Console Dialog Screens Using the SecurityExtension Interface

How a Console Extension Affects the Administration Console

MBean Definition File (MDF) Element Syntax

The MBeanType (Root) Element

The MBeanAttribute Subelement

The MBeanNotification Subelement

The MBeanConstructor Subelement

The MBeanOperation Subelement

Examples: Well-Formed and Valid MBean Definition Files (MDFs)