This chapter describe the contents and organization of this guide - Securing a Production Environment for Oracle WebLogic Server 10.3.6.
This chapter includes the following sections:
This guide describes how to secure a WebLogic Server production environment.
It is intended for the following audiences:
Application Architects — Architects who, in addition to setting security goals and designing the overall security architecture for their organizations, evaluate WebLogic Server security features and determine how to best implement them. Application Architects have in-depth knowledge of Java programming, Java security, and network security, as well as knowledge of security systems and leading-edge, security technologies and tools.
Security Developers — Developers who focus on defining the system architecture and infrastructure for security products that integrate into WebLogic Server and on developing custom security providers for use with WebLogic Server. Security Developers have a solid understanding of security concepts, including authentication, authorization, auditing (AAA), in-depth knowledge of Java (including Java Management eXtensions (JMX), and working knowledge of WebLogic Server and security provider functionality.
Application Developers — Java programmers who develop and add security to Web applications and Enterprise JavaBeans (EJBs), and work with other engineering, quality assurance (QA), and database teams to implement security features. Application Developers have in-depth/working knowledge of Java (including Java Platform, Enterprise Edition (Java EE) Version 5 components such as servlets/JSPs and JSEE) and Java security.
Server Administrators — Administrators who work closely with Application Architects to design a security scheme for the server and the applications running on the server, to identify potential security risks, and to propose configurations that prevent security problems. Related responsibilities may include maintaining critical production systems, configuring and managing security realms, implementing authentication and authorization schemes for server and application resources, upgrading security features, and maintaining security provider databases. Server Administrators have in-depth knowledge of the Java security architecture, including Web services, Web application and EJB security, Public Key security, SSL, and Security Assertion Markup Language (SAML).
Application Administrators — Administrators who work with Server Administrators to implement and maintain security configurations and authentication and authorization schemes, and to set up and maintain access to deployed application resources in defined security realms. Application Administrators have general knowledge of security concepts and the Java Security architecture. They understand Java, XML, deployment descriptors, and can identify security events in server and audit logs.
This document is organized as follows:
This chapter, Chapter 1, "Introduction and Roadmap," introduces the organization of this guide.
Chapter 2, "Determining Your Security Needs," explains how to determine the security needs for your particular environment and describes basic measures to ensure that those needs are being met.
Chapter 3, "Ensuring the Security of Your Production Environment," highlights essential security measures to consider before you deploy WebLogic Server into a production environment and describes how to use different security settings to secure a production environment.
The following Oracle WebLogic Server documents contain information that is relevant to the WebLogic Security Service:
Securing Oracle WebLogic Server — explains how to configure security for WebLogic Server and how to use Compatibility security.
Developing Security Providers for Oracle WebLogic Server — explains how vendors and application developers can develop custom security providers that can be used with WebLogic Server.
Understanding Security for Oracle WebLogic Server — provides an overview of the features, architecture, and functionality of the WebLogic Security Service. It is the starting point for understanding the WebLogic Security Service.
Securing Resources Using Roles and Policies for Oracle WebLogic Server — describes how to secure WebLogic resources. It primarily focuses on securing URL (Web) and Enterprise JavaBean (EJB) resources.
Upgrade Guide for Oracle WebLogic Server — provides procedures and other information you need to upgrade 6.x and earlier versions of WebLogic Server to WebLogic Server 10.3.x. It also provides information about moving applications from a 6.x or earlier version of WebLogic Server to 10.3.x. For specific information on upgrading WebLogic Server security, see "Upgrading a Security Provider" in Upgrade Guide for Oracle WebLogic Server.
Oracle WebLogic Server API Reference — is reference documentation for the WebLogic security packages that are provided with and supported by this release of WebLogic Server.
Oracle provides code samples for Java Authentication and Authorization Service and for Outbound and Two-way SSL for Security developers. The examples and tutorials illustrate WebLogic Server Security in action, and provide practical instructions on how to perform key Security development tasks.
Oracle recommends that you run some or all of the Security examples before developing your own Security configurations.
MedRec is an end-to-end sample Java EE application shipped with WebLogic Server that simulates an independent, centralized medical record management system. The MedRec application provides a framework for patients, doctors, and administrators to manage patient data using a variety of different clients.
MedRec demonstrates WebLogic Server and Java EE features, and highlights Oracle-recommended best practices. MedRec is included in the WebLogic Server distribution, and can be accessed from the Start menu on Windows machines. For Linux and other platforms, you can start MedRec from the WL_HOME\samples\domains\medrec directory, where WL_HOME is the top-level installation directory for WebLogic Platform.
MedRec includes a service tier consisting primarily of Enterprise Java Beans (EJBs) that work together to process requests from Web applications, Web services, workflow applications, and future client applications. The application includes message-driven, stateless session, stateful session, and entity EJBs.
WebLogic Server optionally installs API code examples in WL_HOME\samples\server\examples\src\examples, where WL_HOME is the top-level directory of your WebLogic Server installation. You can start the examples server, and obtain information about the samples and how to run them from the WebLogic Server Start menu.
Additional API examples for download at https://www.samplecode.oracle.com/sf/projects/codesamples/. These examples are distributed as ZIP files that you can unzip into an existing WebLogic Server samples directory structure.
You build and run the downloadable examples in the same manner as you would an installed WebLogic Server example. See the download pages of individual examples for more information at https://www.samplecode.oracle.com/sf/projects/codesamples/.
For a comprehensive listing of the new WebLogic Server features introduced in this release, see What's New in Oracle WebLogic Server.