Administration Console Online Help

JMX Policy Editor

Related Tasks Related Topics

WebLogic Server provides a default set of security policies for its MBeans. Use this assistant to add, edit, or remove the default security policies for an MBean, MBean attribute, or MBean operation.

You can apply (scope) your policy to one of the following:

All instances of all MBeans in the domain.

All instances of a specific MBean in the domain.

All instances of all MBeans that are used to manage a specific deployment or system resource.

All instances of a specific MBean that is used to manage a deployment or system resource.

Each policy can do one of the following:

Control read access for all of an MBean's attributes or for only an attribute that you select.

Control write access for all of an MBean's attributes or for only an attribute that you select.

Control invoke access for all of an MBean's operations or for only an operation that you select.

On the Select Read, Write, or Invoke Privileges page, the Attribute or Operation column contains the following values:

Value Description

Attributes: Permission to Read Selecting this value creates a policy that controls who can read the value of all non-encrypted attributes in the MBean that you selected on the previous page.
If you selected ALL MBEAN TYPES on the previous page, selecting this value controls read access for all non-encrypted attributes in all MBeans that are listed on the previous page.
If you selected a specific MBean type on the previous page, you can either select this value to control read access for all of the MBean's non-encrypted attributes or you can expand this category and choose a specific attribute for which you want to control read access.

Attributes: Permission to Write Selecting this value creates a policy that controls who can write the value of all non-encrypted attributes in the MBean that you selected on the previous page.
If you selected ALL MBEAN TYPES on the previous page, selecting this value controls write access for all non-encrypted attributes in all MBeans that are listed on the previous page.
If you selected a specific MBean type on the previous page, you can either select this value to control write access for all of the MBean's non-encrypted attributes or you can expand this category and choose a specific attribute for which you want to control write access.

Encrypted Attributes: Permission to Read Selecting this value creates a policy that controls who can read the value of all encrypted attributes in the MBean that you selected on the previous page.
When WebLogic Server returns the value of an encrypted attribute, it returns the encrypted value; it does not unencrypt the value.

Encrypted Attributes: Permission to Write Selecting this value creates a policy that controls who can write the value of all encrypted attributes in the MBean that you selected on the previous page.

Lookup Operations: Permission to Invoke Selecting this value creates a policy that controls who can invoke lookup operations in the MBean that you selected on the previous page. JMX clients use lookup operations to retrieve instances of child MBeans.
For example if you want to control which JMX clients are allowed to get a reference to instances of ServerMBean, choose DomainMBean on the previous page and then select the DomainMBean's lookupServer(String name) operation. (You would need to create another policy that controlled read access for DomainMBean's Servers attribute, because this is the other way JMX clients can retrieve instances of child MBeans.)

Operations: Permission to Invoke Selecting this value creates a policy that controls who can invoke operations in the MBean that you selected on the previous page.
If you selected ALL MBEAN TYPES on the previous page, selecting this value controls access for all operations in all MBeans that are listed on the previous page.
If you selected a specific MBean type on the previous page, you can either select this value to control access for all of the MBean's operations or you can expand this category and choose a specific operation for which you want to control access.

Create instances of this MBean using MBean server methods (Applicable to only a few WebLogic Server MBeans) If WebLogic Server allows a JMX client to use the MBean server's create method for instances of the MBean type that you selected on the previous page, selecting this value controls who can create instances of the MBean type using the MBean-server's create method.
Most WebLogic Server MBeans can only be created by invoking operations on the MBean's parent MBean. For example, only the DomainMBean's createServer operation can be used to create instances of ServerMBean.

Unregister instances of this MBean using MBean server methods (Applicable to only a few WebLogic Server MBeans) If WebLogic Server allows a JMX client to use the MBean server's unregister method for instances of the MBean type that you selected on the previous page, selecting this value controls who can unregister instances of the MBean type using the MBean-server's unregister method.

Related Tasks

Create JMX policies

Related Topics

Default Security Policies for MBeans

Security for WebLogic Server MBeans

JMX Resources

WebLogic Server MBean Data Model

Value	Description
Attributes: Permission to Read	Selecting this value creates a policy that controls who can read the value of all non-encrypted attributes in the MBean that you selected on the previous page. If you selected ALL MBEAN TYPES on the previous page, selecting this value controls read access for all non-encrypted attributes in all MBeans that are listed on the previous page. If you selected a specific MBean type on the previous page, you can either select this value to control read access for all of the MBean's non-encrypted attributes or you can expand this category and choose a specific attribute for which you want to control read access.
Attributes: Permission to Write	Selecting this value creates a policy that controls who can write the value of all non-encrypted attributes in the MBean that you selected on the previous page. If you selected ALL MBEAN TYPES on the previous page, selecting this value controls write access for all non-encrypted attributes in all MBeans that are listed on the previous page. If you selected a specific MBean type on the previous page, you can either select this value to control write access for all of the MBean's non-encrypted attributes or you can expand this category and choose a specific attribute for which you want to control write access.
Encrypted Attributes: Permission to Read	Selecting this value creates a policy that controls who can read the value of all encrypted attributes in the MBean that you selected on the previous page. When WebLogic Server returns the value of an encrypted attribute, it returns the encrypted value; it does not unencrypt the value.
Encrypted Attributes: Permission to Write	Selecting this value creates a policy that controls who can write the value of all encrypted attributes in the MBean that you selected on the previous page.
Lookup Operations: Permission to Invoke	Selecting this value creates a policy that controls who can invoke lookup operations in the MBean that you selected on the previous page. JMX clients use lookup operations to retrieve instances of child MBeans. For example if you want to control which JMX clients are allowed to get a reference to instances of `ServerMBean`, choose `DomainMBean` on the previous page and then select the `DomainMBean`'s `lookupServer(String name)` operation. (You would need to create another policy that controlled read access for `DomainMBean`'s `Servers` attribute, because this is the other way JMX clients can retrieve instances of child MBeans.)
Operations: Permission to Invoke	Selecting this value creates a policy that controls who can invoke operations in the MBean that you selected on the previous page. If you selected ALL MBEAN TYPES on the previous page, selecting this value controls access for all operations in all MBeans that are listed on the previous page. If you selected a specific MBean type on the previous page, you can either select this value to control access for all of the MBean's operations or you can expand this category and choose a specific operation for which you want to control access.
Create instances of this MBean using MBean server methods	(Applicable to only a few WebLogic Server MBeans) If WebLogic Server allows a JMX client to use the MBean server's create method for instances of the MBean type that you selected on the previous page, selecting this value controls who can create instances of the MBean type using the MBean-server's create method. Most WebLogic Server MBeans can only be created by invoking operations on the MBean's parent MBean. For example, only the `DomainMBean`'s `createServer` operation can be used to create instances of `ServerMBean`.
Unregister instances of this MBean using MBean server methods	(Applicable to only a few WebLogic Server MBeans) If WebLogic Server allows a JMX client to use the MBean server's unregister method for instances of the MBean type that you selected on the previous page, selecting this value controls who can unregister instances of the MBean type using the MBean-server's unregister method.