15 Custom Authentication Service Provider

In the Oracle Utilities Application Framework, a custom Oracle WebLogic Authentication Service Provider has been provided to support complex domain security configurations.

What Does The Security Provider Do?

The Oracle Utilities Application Framework Service Provider allows Oracle WebLogic domains to be extended with the following additional checks:
  • The provider will check that the authentication user has been defined as a User object within the product. If the user does not exist, then the provider will issue an error to be processed according to the rules in the domain security setup (including using the Oracle WebLogic Adjudicator Providers to implement access rules).
  • If the user exists as a User object within the product, the user record is checked that the user is enabled for use. It is possible to disable a user at the authorization level as well as the authentication level. This provider performs the authorization level check. If the user is disabled, the provider will issue an error to be processed according to the rules in the domain security setup (including using the Oracle WebLogic Adjudicator Providers to implement access rules).

Where Would I Use the Security Provider?

This provider is designed to be used in several security scenarios:

  • If the domain security realm uses several authentication sources, then the Security Provider can be used to decide the order where the checks provided by this provider are executed. By default, the login even performs the same checks after all providers are called, the security provider allows that event to be done earlier in the chain.
  • If the implementation is using single sign on (SSO) or federated security, this security provider can be used to decide when the checks performed are done in relation to these configurations.

By default, the checks performed by this provider are done automatically by the product login process. Use of the provider allows implementations to perform these checks earlier in the security checking process.

Implementing the Security Provider

Note:

Before using the provider ensure a data source has been created to connect to the product database to access the SC_USER table.

Note:

Each Plugin Properties must exist on a separate line

The Oracle Utilities Application Framework security provider is provided in the $SPLEBASE/tools/bin/auth subdirectory as ouaf-dbmsauth-<version>.jar. This jar file must be copied to the $DOMAIN_HOME/lib directory. After restarting the Administration server, the following must be configured to use this security provider:

  • Login to the Oracle WebLogic Administration console using the appropriate administrator account.
  • Navigate to the Security Realms, the myrealm, then Providers tab from the console.
  • Select New to add a new Provider.
  • Assign an appropriate name for the provider according to your site standards.
  • Use the CustomDBMSAuthenticator for the Provider type.
  • Click Ok to save the authenticator definition.
  • Select the Name you assigned the provider to complete the configuration.
  • Select the appropriate Control Flag for your site standards to determine the how the provider fits into the login sequence.
  • Select the Provider Specific tab to configure the provider using the following settings:
    • Specify the data source created to connect to the database created earlier in the Data Source Name attribute.
    • Specify com.oracle.ouaf.fed.OuafDBMSAuthenticator for the Plugin Class Name.
    • Specify the userGroup=<usergroupname> where <usergroupname> is the realm group created for the product (set by WEB_APPVIEWER_ROLE_NAME) in the Plugin Properties. By default, this is set to cisusers if parameter not present. For example:

      userGroup=cisusers

    • Optionally, specify the users you wish to bypass from this Security provider by specifying the excludeUser=<listofusers> where <listofusers> is a list of authentication users delimited by "," to be excluded. For example:

      excludeUsers=system,weblogic,OracleSystemUser

  • Save the Provider configuration.
  • Optionally, use Reorder to set the order of check.
  • Optionally, configure the Adjudicator Provider for additional rules.