Jump to

• Request
• Response

Modify This Security Configuration

post

/management/weblogic/{version}/edit/securityConfiguration

Modify this security configuration.

Request

Supported Media Types

• application/json

Path Parameters

• version: string
  The version of the WebLogic REST interface.

Header Parameters

• X-Requested-By: string
  The 'X-Requested-By' header is used to protect against Cross-Site Request Forgery (CSRF) attacks. The value is an arbitrary name such as 'MyClient'.

Body ()

Must contain the modified security configuration model.

Root Schema : Security Configuration

Type: object

Show Source

• administrativeIdentityDomain(optional): string

  Domain's administrative identity domain.

• bootAuthenticationMaxRetryDelay(optional): integer(int64)
  Default Value: 60000

  The maximum length of time, in milliseconds, the boot process will wait before retrying the authentication after a login server not available exception. The boot process will use a backoff algorithm starting at 100 milliseconds increasing on each failure until the delay time reaches the MaxRetryDelay value.

• bootAuthenticationRetryCount(optional): integer(int32)
  Minimum Value: 0

  The maximum number of times the boot process will try to authenticate the boot user with the authentication providers. The authentication will be retried only if a failure occurs that indicates the login server is not available.

• clearTextCredentialAccessEnabled(optional): boolean
  Default Value: false

  Returns true if allow access to credential in clear text. This can be overridden by the system property -Dweblogic.management.clearTextCredentialAccessEnabled

• compatibilityConnectionFiltersEnabled(optional): boolean
  Default Value: false

  Specifies whether this WebLogic Server domain enables compatiblity with previous connection filters.

  This attribute changes the protocols names used when filtering needs to be performed.

• connectionFilter(optional): string
  Default Value: oracle.doceng.json.BetterJsonNull@7b563e0a

  The name of the Java class that implements a connection filter (that is, the weblogic.security.net.ConnectionFilter interface). If no class name is specified, no connection filter will be used.

  This attribute replaces the deprecated ConnectionFilter attribute on the SecurityMBean.

• connectionFilterRules(optional): array Items
  Title: Items

  The rules used by any connection filter that implements the ConnectionFilterRulesListener interface. When using the default implementation and when no rules are specified, all connections are accepted. The default implementation rules are in the format: target localAddress localPort action protocols

  This attribute replaces the deprecated ConnectionFilterRules attribute on the SecurityMBean.

• connectionLoggerEnabled(optional): boolean
  Default Value: false

  Specifies whether this WebLogic Server domain should log accepted connections.

  This attribute can be used by a system administrator to dynamically check the incoming connections in the log file to determine if filtering needs to be performed.

  This attribute replaces the deprecated ConnectionLoggerEnabled attribute on the SecurityMBean.

• consoleFullDelegationEnabled(optional): boolean
  Default Value: false

  Indicates whether the console is enabled for fully delegate authorization.

• credential(optional): string(password)

  The password for the domain. In WebLogic Server version 6.0, this attribute was the password of the system user. In WebLogic Server version 7.0, this attribute can be any string. For the two domains to interoperate, the string must be the same for both domains.

  When you set the value of this attribute, WebLogic Server does the following:

  1. Encrypts the value.

  2. Sets the value of the UserPasswordEncrypted attribute to the encrypted value.

• crossDomainSecurityEnabled(optional): boolean
  Default Value: false

  Indicates whether or not cross-domain security is enabled.

• defaultRealm(optional): array Realm Reference
  Title: Realm Reference

  Contains the realm reference.

  Returns the default security realm or null if no realm has been selected as the default security realm.

  Constraints

  • restart required
• downgradeUntrustedPrincipals(optional): boolean
  Default Value: false

  Whether or not to downgrade to anonymous principals that cannot be verified. This is useful for server-server communication between untrusted domains.

  Constraints

  • secure default : false
• dynamicallyCreated(optional): boolean
  Read Only: true

  Default Value: false

  Return whether the MBean was created dynamically or is persisted to config.xml

• enforceStrictURLPattern(optional): boolean
  Default Value: true

  Whether or not the system should enforce strict URL pattern or not.

• enforceValidBasicAuthCredentials(optional): boolean
  Default Value: true

  Whether or not the system should allow requests with invalid Basic Authentication credentials to access unsecure resources.

• excludedDomainNames(optional): array Items
  Title: Items

  Specifies a list of remote domains for which cross-domain check should not be applied.

• id(optional): integer(int64)
  Read Only: true

  Return the unique id of this MBean instance

• identityDomainAwareProvidersRequired(optional): boolean
  Default Value: false

  Returns true if all role mapping, authorization, credential mapping, and audit providers configured in the domain must support the IdentityDomainAwareProviderMBean interface's administrative identity domain.

• name(optional): string
  Read Only: true

  The user-specified name of this MBean instance.

  This name is included as one of the key properties in the MBean's javax.management.ObjectName

  Name=user-specified-name

  Constraints

  • legal null
• nodeManagerPassword(optional): string(password)

  The password that the Administration Server uses to communicate with Node Manager when starting, stopping, or restarting Managed Servers.

  When you get the value of this attribute, WebLogic Server does the following:

  1. Retrieves the value of the NodeManagerPasswordEncrypted attribute.

  2. Decrypts the value and returns the unencrypted password as a String.

  When you set the value of this attribute, WebLogic Server does the following:

  1. Encrypts the value.

  2. Sets the value of the NodeManagerPasswordEncrypted attribute to the encrypted value.

  Using this attribute (NodeManagerPassword) is a potential security risk because the String object (which contains the unencrypted password) remains in the JVM's memory until garbage collection removes it and the memory is reallocated. Depending on how memory is allocated in the JVM, a significant amount of time could pass before this unencrypted data is removed from memory.

  Instead of using this attribute, you should use NodeManagerPasswordEncrypted

• nodeManagerUsername(optional): string
  Default Value:

  The user name that the Administration Server uses to communicate with Node Manager when starting, stopping, or restarting Managed Servers.

• nonceTimeoutSeconds(optional): integer(int32)
  Minimum Value: 15

  Default Value: 120

  Returns the value of the nonce timeout in seconds.

• notes(optional): string

  Optional information that you can include to describe this configuration.

  WebLogic Server saves this note in the domain's configuration file (config.xml) as XML PCDATA. All left angle brackets (<) are converted to the xml entity <. Carriage returns/line feeds are preserved.

  Note: If you create or edit a note from the Administration Console, the Administration Console does not preserve carriage returns/line feeds.

• principalEqualsCaseInsensitive(optional): boolean
  Default Value: false

  Specifies whether the WebLogic Server principal name is compared using a case insensitive match when the equals method for the principal object is performed.

  If this attribute is enabled, matches are case insensitive.

  Note: Note that principal comparison is not used by the WebLogic Security Service to determine access to protected resources. This attribute is intended for use with JAAS authorization, which may require case insensitive principal matching behavior.

• principalEqualsCompareDnAndGuid(optional): boolean
  Default Value: false

  Specifies whether the GUID and DN data in a WebLogic Server principal object are used when the equals method of that object is invoked.

  If enabled, the GUID and DN data (if included among the attributes in a WebLogic Server principal object) and the principal name are compared when this method is invoked.

• remoteAnonymousJNDIEnabled(optional): boolean
  Default Value: true

  Returns true if remote anonymous JNDI access is permitted for list and modify operations.

  Constraints

  • secure default : false
• tags(optional): array Items
  Title: Items

  Return all tags on this Configuration MBean

• type(optional): string
  Read Only: true

  Returns the type of the MBean.

  Constraints

  • unharvestable
• useKSSForDemo(optional): boolean
  Default Value: false

  Determines whether the Demo Identity and Demo Trust key stores should be obtained from the Oracle Key Store Service (KSS).

  If enabled, Weblogic Server will request the Demo Identity and Domain Trust key stores from KSS. Subsequent to installation however, the KSS Demo key stores may have been manipulated such that appropriate Demo certificates or keys are not available.

  Please verify the following KSS Demo Identity keystore has an X.509 private key and corresponding public identity certificate signed by the Demo Certificate Authority (CA):

  KSS Stripe

  system

  KSS Key Store

  demoidentity

  KSS Private Key Alias

  DemoIdentity

  Please verify the following KSS Domain Trust keystore has a trusted Demo Certificate Authority X.509 certificate:

  KSS Stripe

  system

  KSS Key Store

  trust

• webAppFilesCaseInsensitive(optional): string
  Default Value: false

  Allowed Values: [ "os", "true", "false" ]

  This property defines the case sensitive URL-pattern matching behavior for security constraints, servlets, filters, virtual-hosts, and so on, in the Web application container and external security policies. Note: This is a Windows-only flag that is provided for backward compatibility when upgrading from pre-9.0 versions of WebLogic Server. On Unix platforms, setting this value to true causes undesired behavior and is not supported. When the value is set to os, the pattern matching will be case- sensitive on all platforms except the Windows file system. Note that on non-Windows file systems, WebLogic Server does not enforce case sensitivity and relies on the file system for optimization. As a result, if you have a Windows Samba mount from Unix or Mac OS that has been installed in case-insensitive mode, there is a chance of a security risk. If so, specify case-insensitive lookups by setting this attribute to true. Note also that this property is used to preserve backward compatibility on Windows file systems only. In prior releases, WebLogic Server was case- insensitive on Windows. As of WebLogic Server 9.0, URL-pattern matching is strictly enforced. During the upgrade of older domains, the value of this parameter is explicitly set to os by the upgrade plug-in to preserve backward compatibility.

{
    "type":"object",
    "properties":{
        "administrativeIdentityDomain":{
            "type":"string",
            "description":"<p>Domain's administrative identity domain.</p>"
        },
        "bootAuthenticationMaxRetryDelay":{
            "default":60000,
            "type":"integer",
            "format":"int64",
            "description":"<p>The maximum length of time, in milliseconds, the boot process will wait before retrying the authentication after a login server not available exception. The boot process will use a backoff algorithm starting at 100 milliseconds increasing on each failure until the delay time reaches the MaxRetryDelay value.</p>"
        },
        "bootAuthenticationRetryCount":{
            "minimum":0,
            "type":"integer",
            "format":"int32",
            "description":"<p>The maximum number of times the boot process will try to authenticate the boot user with the authentication providers. The authentication will be retried only if a failure occurs that indicates the login server is not available.</p>"
        },
        "clearTextCredentialAccessEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Returns true if allow access to credential in clear text. This can be overridden by the system property <code>-Dweblogic.management.clearTextCredentialAccessEnabled</code></p>"
        },
        "compatibilityConnectionFiltersEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Specifies whether this WebLogic Server domain enables compatiblity with previous connection filters.</p><p>This attribute changes the protocols names used when filtering needs to be performed.</p>"
        },
        "connectionFilter":{
            "default":null,
            "type":"string",
            "description":"<p>The name of the Java class that implements a connection filter (that is, the <code>weblogic.security.net.ConnectionFilter</code> interface). If no class name is specified, no connection filter will be used.</p><p> This attribute replaces the deprecated ConnectionFilter attribute on the SecurityMBean.</p>"
        },
        "connectionFilterRules":{
            "default":null,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>The rules used by any connection filter that implements the <code>ConnectionFilterRulesListener</code> interface. When using the default implementation and when no rules are specified, all connections are accepted. The default implementation rules are in the format: <code>target localAddress localPort action protocols</code></p><p> This attribute replaces the deprecated ConnectionFilterRules attribute on the SecurityMBean.</p>"
        },
        "connectionLoggerEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Specifies whether this WebLogic Server domain should log accepted connections.</p><p>This attribute can be used by a system administrator to dynamically check the incoming connections in the log file to determine if filtering needs to be performed.</p><p> This attribute replaces the deprecated ConnectionLoggerEnabled attribute on the SecurityMBean.</p>"
        },
        "consoleFullDelegationEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Indicates whether the console is enabled for fully delegate authorization.</p>"
        },
        "credential":{
            "type":"string",
            "format":"password",
            "description":"<p>The password for the domain. In WebLogic Server version 6.0, this attribute was the password of the system user. In WebLogic Server version 7.0, this attribute can be any string. For the two domains to interoperate, the string must be the same for both domains.</p><p>When you set the value of this attribute, WebLogic Server does the following:</p><ol><li><p>Encrypts the value.</p></li><li><p>Sets the value of the <code>UserPasswordEncrypted</code> attribute to the encrypted value.</p></li></ol>"
        },
        "crossDomainSecurityEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p> Indicates whether or not cross-domain security is enabled.</p>"
        },
        "defaultRealm":{
            "x-weblogic-restartRequired":true,
            "title":"Realm Reference",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"Contains the realm reference. <p>Returns the default security realm or null if no realm has been selected as the default security realm.</p><p><h5>Constraints</h5></p><ul><li>restart required</li></ul>"
        },
        "downgradeUntrustedPrincipals":{
            "x-weblogic-secureDefault":false,
            "default":false,
            "type":"boolean",
            "description":"<p>Whether or not to downgrade to anonymous principals that cannot be verified. This is useful for server-server communication between untrusted domains.</p><p><h5>Constraints</h5></p><ul><li>secure default : false</li></ul>"
        },
        "dynamicallyCreated":{
            "readOnly":true,
            "default":false,
            "type":"boolean",
            "description":"<p>Return whether the MBean was created dynamically or is persisted to config.xml</p>"
        },
        "enforceStrictURLPattern":{
            "default":true,
            "type":"boolean",
            "description":"<p>Whether or not the system should enforce strict URL pattern or not.</p>"
        },
        "enforceValidBasicAuthCredentials":{
            "default":true,
            "type":"boolean",
            "description":"<p>Whether or not the system should allow requests with invalid Basic Authentication credentials to access unsecure resources.</p>"
        },
        "excludedDomainNames":{
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p> Specifies a list of remote domains for which cross-domain check should not be applied.</p>"
        },
        "id":{
            "readOnly":true,
            "type":"integer",
            "format":"int64",
            "description":"<p>Return the unique id of this MBean instance</p>"
        },
        "identityDomainAwareProvidersRequired":{
            "default":false,
            "type":"boolean",
            "description":"<p>Returns true if all role mapping, authorization, credential mapping, and audit providers configured in the domain must support the IdentityDomainAwareProviderMBean interface's administrative identity domain.</p>"
        },
        "name":{
            "readOnly":true,
            "x-weblogic-legalNull":true,
            "type":"string",
            "description":"<p>The user-specified name of this MBean instance.</p><p>This name is included as one of the key properties in the MBean's <code>javax.management.ObjectName</code></p><p><code>Name=<i>user-specified-name</i></code></p><p><h5>Constraints</h5></p><ul><li>legal null</li></ul>"
        },
        "nodeManagerPassword":{
            "type":"string",
            "format":"password",
            "description":"<p>The password that the Administration Server uses to communicate with Node Manager when starting, stopping, or restarting Managed Servers. </p><p>When you get the value of this attribute, WebLogic Server does the following:</p><ol><li><p>Retrieves the value of the <code>NodeManagerPasswordEncrypted</code> attribute.</p></li><li><p>Decrypts the value and returns the unencrypted password as a String.</p></li></ol><p>When you set the value of this attribute, WebLogic Server does the following:</p><ol><li><p>Encrypts the value.</p></li><li><p>Sets the value of the <code>NodeManagerPasswordEncrypted</code> attribute to the encrypted value.</p></li></ol><p>Using this attribute (<code>NodeManagerPassword</code>) is a potential security risk because the String object (which contains the unencrypted password) remains in the JVM's memory until garbage collection removes it and the memory is reallocated. Depending on how memory is allocated in the JVM, a significant amount of time could pass before this unencrypted data is removed from memory.</p><p>Instead of using this attribute, you should use <code>NodeManagerPasswordEncrypted</code></p>"
        },
        "nodeManagerUsername":{
            "default":"",
            "type":"string",
            "description":"<p>The user name that the Administration Server uses to communicate with Node Manager when starting, stopping, or restarting Managed Servers. </p>"
        },
        "nonceTimeoutSeconds":{
            "default":120,
            "minimum":15,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the value of the nonce timeout in seconds.</p>"
        },
        "notes":{
            "type":"string",
            "description":"<p>Optional information that you can include to describe this configuration.</p><p>WebLogic Server saves this note in the domain's configuration file (<code>config.xml</code>) as XML PCDATA. All left angle brackets (<) are converted to the XML entity <code>&lt;</code>. Carriage returns/line feeds are preserved.</p><p>Note: If you create or edit a note from the Administration Console, the Administration Console does not preserve carriage returns/line feeds.</p>"
        },
        "principalEqualsCaseInsensitive":{
            "default":false,
            "type":"boolean",
            "description":"<p>Specifies whether the WebLogic Server principal name is compared using a case insensitive match when the equals method for the principal object is performed.</p><p>If this attribute is enabled, matches are case insensitive.</p><p><b>Note:</b> Note that principal comparison is not used by the WebLogic Security Service to determine access to protected resources. This attribute is intended for use with JAAS authorization, which may require case insensitive principal matching behavior.</p>"
        },
        "principalEqualsCompareDnAndGuid":{
            "default":false,
            "type":"boolean",
            "description":"<p>Specifies whether the GUID and DN data in a WebLogic Server principal object are used when the equals method of that object is invoked. </p><p>If enabled, the GUID and DN data (if included among the attributes in a WebLogic Server principal object) and the principal name are compared when this method is invoked.</p>"
        },
        "remoteAnonymousJNDIEnabled":{
            "x-weblogic-secureDefault":false,
            "default":true,
            "type":"boolean",
            "description":"<p>Returns true if remote anonymous JNDI access is permitted for list and modify operations.</p><p><h5>Constraints</h5></p><ul><li>secure default : false</li></ul>"
        },
        "tags":{
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Return all tags on this Configuration MBean</p>"
        },
        "type":{
            "readOnly":true,
            "x-weblogic-unharvestable":true,
            "type":"string",
            "description":"<p>Returns the type of the MBean.</p><p><h5>Constraints</h5></p><ul><li>unharvestable</li></ul>"
        },
        "useKSSForDemo":{
            "default":false,
            "type":"boolean",
            "description":"<p>Determines whether the Demo Identity and Demo Trust key stores should be obtained from the Oracle Key Store Service (KSS).</p><p>If enabled, Weblogic Server will request the Demo Identity and Domain Trust key stores from KSS. Subsequent to installation however, the KSS Demo key stores may have been manipulated such that appropriate Demo certificates or keys are not available.</p><p>Please verify the following KSS Demo Identity keystore has an X.509 private key and corresponding public identity certificate signed by the Demo Certificate Authority (CA):</p><dl><dt>KSS Stripe</dt><dd><p>system</p></dd><dt>KSS Key Store</dt><dd><p>demoidentity</p></dd><dt>KSS Private Key Alias</dt><dd><p>DemoIdentity</p></dd></dl><p>Please verify the following KSS Domain Trust keystore has a trusted Demo Certificate Authority X.509 certificate:</p><dl><dt>KSS Stripe</dt><dd><p>system</p></dd><dt>KSS Key Store</dt><dd><p>trust</p></dd></dl>"
        },
        "webAppFilesCaseInsensitive":{
            "default":"false",
            "enum":[
                "os",
                "true",
                "false"
            ],
            "type":"string",
            "description":"<p>This property defines the case sensitive URL-pattern matching behavior for security constraints, servlets, filters, virtual-hosts, and so on, in the Web application container and external security policies.  <b>Note:</b> This is a Windows-only flag that is provided for backward compatibility when upgrading from pre-9.0 versions of WebLogic Server. On Unix platforms, setting this value to <code>true</code> causes undesired behavior and is not supported.  When the value is set to <code>os</code>, the pattern matching will be case- sensitive on all platforms except the Windows file system.  Note that on non-Windows file systems, WebLogic Server does not enforce case sensitivity and relies on the file system for optimization. As a result, if you have a Windows Samba mount from Unix or Mac OS that has been installed in case-insensitive mode, there is a chance of a security risk. If so, specify case-insensitive lookups by setting this attribute to <code>true</code>.  Note also that this property is used to preserve backward compatibility on Windows file systems only. In prior releases, WebLogic Server was case- insensitive on Windows. As of WebLogic Server 9.0, URL-pattern matching is strictly enforced.  During the upgrade of older domains, the value of this parameter is explicitly set to <code>os</code> by the upgrade plug-in to preserve backward compatibility.</p>"
        }
    },
    "description":""
}

Nested Schema : Items

Type: array

Title: Items

The rules used by any connection filter that implements the ConnectionFilterRulesListener interface. When using the default implementation and when no rules are specified, all connections are accepted. The default implementation rules are in the format: target localAddress localPort action protocols

This attribute replaces the deprecated ConnectionFilterRules attribute on the SecurityMBean.

Default Value: oracle.doceng.json.BetterJsonNull@e7aada5

Show Source

• Array of: string

{
    "default":null,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>The rules used by any connection filter that implements the <code>ConnectionFilterRulesListener</code> interface. When using the default implementation and when no rules are specified, all connections are accepted. The default implementation rules are in the format: <code>target localAddress localPort action protocols</code></p><p> This attribute replaces the deprecated ConnectionFilterRules attribute on the SecurityMBean.</p>"
}

Nested Schema : Realm Reference

Type: array

Title: Realm Reference

Contains the realm reference.

Returns the default security realm or null if no realm has been selected as the default security realm.

Constraints

• restart required

Show Source

• Array of: string

{
    "x-weblogic-restartRequired":true,
    "title":"Realm Reference",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"Contains the realm reference. <p>Returns the default security realm or null if no realm has been selected as the default security realm.</p><p><h5>Constraints</h5></p><ul><li>restart required</li></ul>"
}

Nested Schema : Items

Type: array

Title: Items

Specifies a list of remote domains for which cross-domain check should not be applied.

Show Source

• Array of: string

{
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p> Specifies a list of remote domains for which cross-domain check should not be applied.</p>"
}

Nested Schema : Items

Type: array

Title: Items

Return all tags on this Configuration MBean

Show Source

• Array of: string

{
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Return all tags on this Configuration MBean</p>"
}

Security

• Admin: basic
  Type: basic

  Description: A user in the Admin security role.

Back to Top

Response

200 Response

Back to Top