![]() ![]() ![]() ![]() ![]() ![]() |
This tutorial describes how to secure Enterprise JavaBean (EJB) resources by using the Administration Console. It includes step-by-step procedures for creating scoped roles and security policies at various levels in the EJB resource hierarchy.
WARNING: | This tutorial does not mimic the security configuration of the out-of-the-box MedRec application. Rather, it walks you through a series of steps that secure different levels of EJBs. After each step, you attempt to access the EJB resource to see the effect of implementing the security policy. It does not necessarily reflect a real-life scenario; the procedures just show you what is possible. At the end of the tutorial consider deleting the security policies you created so that the application returns to its correct security configuration. The configured security policies actually interfere with the correct functioning of the MedRec application. |
The tutorial includes the following sections:
Before starting this tutorial:
MedRecDomain
and MedRecServer
, and start MedRecServer
. See Tutorial 1: Creating a WebLogic Domain and Server Instance for Development.
To secure Enterprise JavaBean (EJB) resources by using the Administration Console:
medrecEar
.sessionEjbs
EJB module.This page displays all the scoped roles currently defined in the WebLogic Role Mapping provider's database.
Selecting this option enables you to create a security role that is scoped to this particular EJB JAR. Thereafter, the scoped role can be used in a security policy for this EJB JAR.
MedRecSessionEJBPatient
.MedRecSessionEJBPatient
.Group
.MedRecPatients
.Note: | You created the MedRecPatients group as part of Tutorial 16: Creating Users, Groups, and Global Security Roles. Recall that user larry@bball.com is the only user in this group. |
The Role Conditions sections includes the entry Group MedRecPatients
.
MedRecSessionEJBAdmin
and grant this scoped role to the MedRecAdmins
group.medrecEar
.sessionEjbs
EJB module.From this page you can create a security policy at the EJB JAR level, which includes all EJBs within the JAR, and all methods within those EJBs.
Role
.MedRecSessionEJBPatient
.
The Policy Conditions section includes the entry Role MedRecSessionEJBPatient
.
The Overwritten Policy section includes the entry Group everyone
.
By defining this security policy for the sessionEjbs
JAR, you are overriding any security policies that have already been defined for the EJB resource type. For example, if you had previously specified that the entire medrecEar
application can be accessed only by the MedRecAdmin
role, then the Overwritten Policy section would include the text Role MedRecAdmin
.
However, in this case you are only overwriting the default security policy (Group everyone
).
For more information about default security policies, see Default Security Policies in Securing WebLogic Resources.
http://
host
:7101/admin
, where host
refers to the computer hosting MedRecServer
. If your browser is on the same computer, then you can use the URL http://localhost:7101/admin
.
admin@avitek.com
, and in the Password field, type weblogic
, then click Login.
Remember that in Tutorial 17: Securing URL (Web) Resources Using the Administration Console, you granted the MedRecAdmin
role permission to access the admin
Web Application. Because admin@avitek.com
has been assigned the MedRecAdmin
role (via the MedRecAdmins
group), the admin@avitek.com
user is thus allowed to log in to the admin
Web Application.
The browser returns the following error:
[EJB:010160]Security Violation: User: 'admin@avitek.com' has insufficient permission to access EJB: type=<ejb>, application=medrecEar, module=sessionEjbs, ejb=AdminSessionEJB, method=findNewUsers, methodInterface=Remote, signature={}.
The error is displayed because access to the findNewUsers()
method in AdminSessionEJB
, an EJB within the sessionEjbs
JAR you previously secured, is needed to view pending requests. User admin@avitek.com
is not granted the MedRecSessionEJBPatient
scoped role that was used to create the security policy, and therefore is not granted access.
medrecEar
.AdminSessionEJB
EJB module.From this page you can create a security policy for the specified EJB, either at the EJB level (meaning the security policy will apply to all methods within the EJB), or a particular method within the EJB.
ALL
is selected.Role
.MedRecSessionEJBAdmin
.
The Policy Conditions section includes the entry Role MedRecSessionEJBAdmin
.
The Overwritten Policy section includes the entry Role MedRecSessionEJBPatient
.
By defining this security policy for AdminSessionEJB
, you are overriding the security policy that has already been defined for the EJB JAR in Step 2: Secure the sessionEjbs JAR. Specifically, you are overriding the inherited policy statement of Role MedRecSessionEJBPatient
.
Repeat steps 1 - 3 in Step 3: Attempt to access an EJB in the SessionEJB JAR..
Instead of displaying the error page, the browser now displays the list of pending requests.
This result occurs because user admin@avitek.com
has been granted the MedRecEJBSessionAdmin
scoped role. This scoped role was used to create the security policy for AdminSessionEJB
, the EJB containing the findNewUsers()
method that is needed to view pending requests.
medrecEar
.AdminSessionEJB
EJB module.From this page you can create a security policy for the specified EJB, either at the EJB level (meaning the security policy will apply to all methods within the EJB), or a particular method within the EJB.
findNewUsers() - REMOTE
.Role
.MedRecSessionEJBPatient
.
You defined this scoped role on SessionEJB
, but because the findNewUsers()
method is a component of AdminSessionEJB
(itself a component of SessionEJB
), you can also use it here.
The Policy Conditions section includes the entry Role MedRecSessionEJBPatient
.
The Overwritten Policy section includes the entry Role MedRecSessionEJBAdmin
.
By defining this security policy on the findNewUsers()
method, you are overriding the security policy that has already been defined for AdminSessionEJB
in Step 4: Secure the AdminSessionEJB.. Specifically, you are overriding the inherited policy statement of Role MedRecSessionEJBAdmin
that is shown when ALL
is selected from the EJB Component Methods drop-down list.
Repeat steps 1 - 3 in Step 3: Attempt to access an EJB in the SessionEJB JAR..
The browser displays an error page. This result occurs because only users granted the scoped role MedRecSessionEJBPatient
can access the findNewUsers()
method, which is needed to view pending requests. User admin@avitek.com
is not granted the scoped role that was used to create the security policy, and therefore is not granted access.
The security policies configured in this tutorial do not mimic the out-of-the-box security configuration of the MedRec application, but rather, simply provide examples of how you can secure EJB policies if you choose to do so in your own applications. The configured security policies actually interfere with the correct functioning of the MedRec application, so if you want to run the application without problems, you should remove the security policies as described in the following procedure.
medrecEar
.sessionEjbs
EJB module.Role MedRecSessionEJBPatient
.AdminSessionEJB
EJB module of the medrecEar
application.ALL
.Role MedRecSessionAdmin
.findNewUsers() - REMOTE
.Role MedRecSessionEJBPatient
.
Nmtoken
in the
Extensible Markup Language (XML) recommendation. The BEA convention is that security role names are singular.Role
policy condition.
This tutorial shows you how to secure application and various Enterprise JavaBean (EJB) resources. The examples here do not reflect the security configuration of the out-of-the-box MedRec application. However, the full MedRec application uses these same principles (as well as programmatic security) to secure EJB resources for both MedRec administrators and patients.
![]() ![]() ![]() |