Secure WebLogic resources

Before you begin

Read Understanding WebLogic Resource Security

A WebLogic resource represents an underlying WebLogic Server entity that can be protected from unauthorized access using security policies. Examples of WebLogic resources include Administrative resources, Server resources, Enterprise Applications (EARs), EJBs (JARs), and Web Applications (WARs).

The main steps for securing a WebLogic resource are:

Determine which WebLogic resource to secure.
For more information, see Types of WebLogic resources
If you want to secure an EJB or Web application resource:
1. Understand the options you have for securing these resources. Read Options for Securing EJB and Web Application Resources
2. Decide which technique you want to use. You can use Deployment Descriptors only, the Administration Console only, or a combination of the two. See Choose A Security Technique
3. Decide which security deployment model to use. This depends on the security technique you choose. See Choose A Security Model
4. If you choose the Advanced security deployment model (compatible with WebLogic Server version 8.1) you might need to reset some realm configurations after the initial deployment. See Manage security for EJBs and Web applications
5. If the technique and model you choose include using the Administration Console to secure your Web application or EJB resource, follow the instructions in step 3.
Use the WebLogic Administration Console to secure your WebLogic resource:
1. Create users and groups, representations of individuals and collections of individuals, who may be granted a security role.
  For more information, see Manage users and groups
2. Create security roles, which are dynamically computed privileges granted to users or groups based (optionally) on specific conditions. You can create global roles, which apply to all resources, or scoped roles which apply to selected resources.
  BEA recommends creating security roles and using them (rather than users or groups) to secure WebLogic resources, because doing so increases efficiency for administrators who work with many users.
  
  For more information, see Manage security roles
3. Create security policies, which are associations between the WebLogic server and a user, group, or security role, that specify who has access to the WebLogic Resource and under what conditions.
  For more information, see Manage security policies