Securing Product Access
The JNDI registers all the resources used in the Oracle WebLogic domain for the product. For the product to operate the following is recommended:
• Administration Users should be part of an Admin role. Additional roles are supplied with Oracle WebLogic.
• Product users are in group designated by the WEB_PRINCIPAL_NAME and WEB_ROLE_NAME settings in the ENVIRON.INI.
• Optionally, it is possible to create additional groups in your security repository to allocate specific permissions. This is outlined in Providing Additional Access to the JNDI.
• View the JNDI tree for the product servers/clusters in the console and assign the following policies:
Resource
Role/Group
Server Resources
Allocate to Admin role or individual administration accounts. This is required to start/stop and maintain the JNDI resources for the server.
JMX Resources
Allocate to Admin role or individual administration accounts. This is required to monitor the server from the console, Fusion Middleware Control and/or Oracle Enterprise Manager using the JMX interface. If the Oracle Management Pack for Oracle Utilities, this may also need to allocate to the Product group/role or individual users if the credentials used for the connection are not associated with any users in the Admin group.
JDBC Resources
Allocated to both Admin role/individual administration users and Product group/role to allow access to JDBC connection pools.
EJB Resources
Allocate to Product group/role to allow access to Business Application Server.
JMS Resources
Allocate to Product group/role to allow access for MDB, Outbound Message via JMS or JMS Real Time Adapter access.
• It is also recommended to set the weblogic.jdbc.remoteEnabled to false in the JAVA_OPTIONS and WLS_JDBC_REMOTE_ENABLED variables in the setDomainEnv.sh utility provided with Oracle WebLogic or by ese. For example:
-Dweblogic.jdbc.remoteEnabled=false
• If the SSL protocol is used it is recommended to set the RMI JDBC Setting to Secure on the Product Server/Cluster Advanced Settings.
• Save the JNDI changes.