17 Securing JNDI Access

By default, the JNDI used for the Oracle WebLogic Domain is open to read access by any valid user in the domain. This behavior may not be appropriate as dictated by the security policies at your site. It is possible to set the domain permissions, after installation, to minimize access to the JNDI.

Note:

The instructions in this section use the JNDI facilities described in the Access policies for JNDI resources section and Resource Types You Can Secure With Policies of the Oracle WebLogic documentation. Refer to that section before configuring the security of the JNDI.

Securing Product Access

The JNDI registers all the resources used in the Oracle WebLogic domain for the product. For the product to operate the following is recommended:

  • Administration Users should be part of an Admin role. Additional roles are supplied with Oracle WebLogic.
  • Product users are in group designated by the WEB_PRINCIPAL_NAME and WEB_ROLE_NAME settings in the ENVIRON.INI
  • Optionally, it is possible to create additional groups in your security repository to allocate specific permissions. This is outlined in Providing Additional Access to the JNDI.
  • View the JNDI tree for the product servers/clusters in the console and assign the following policies:
    Resource Role/Group
    Server Resources Allocate to Admin role or individual administration accounts. This is required to start/stop and maintain the JNDI resources for the server.
    JMX Resources Allocate to Admin role or individual administration accounts. This is required to monitor the server from the console, Fusion Middleware Control and/or Oracle Enterprise Manager using the JMX interface. If the Oracle Management Pack for Oracle Utilities, this may also need to allocate to the Product group/role or individual users if the credentials used for the connection are not associated with any users in the Admin group.
    JDBC Resources Allocated to both Admin role/individual administration users and Product group/role to allow access to JDBC connection pools.
    EJB Resources Allocate to Product group/role to allow access to Business Application Server.
    JMS Resources Allocate to Product group/role to allow access for MDB, Outbound Message via JMS or JMS Real Time Adapter access.
  • It is also recommended to set the weblogic.jdbc.remoteEnabled to false in the JAVA_OPTIONS and WLS_JDBC_REMOTE_ENABLED variables in the setDomainEnv.sh utility provided with Oracle WebLogic. For example:

    -Dweblogic.jdbc.remoteEnabled=false

  • If the SSL protocol is used it is recommended to set the RMI JDBC Setting to Secure on the Product Server/Cluster Advanced Settings.
  • Save the JNDI changes.

Providing Additional Access to the JNDI

If third party access is required for access to the JNDI of the product then the following is recommended:

  • Set up the role or group in your security repository. In a configuration where multiple security repositories exist; this identity should only exist in one repository.
  • Allocate the relevant permission as outlined in Access policies for JNDI resources section and Resource Types You Can Secure With Policies of the Oracle WebLogic documentation.
  • The configuration of this additional access should be appended to the existing configuration.