Jump to

• Request
• Response

View This Realm Collection

get

/management/weblogic/{version}/edit/securityConfiguration/realms

View this realm collection.

Request

Path Parameters

• version(required): string
  The version of the WebLogic REST interface.

Query Parameters

• excludeFields: string
  The 'excludeFields' query parameter is used to restrict which fields are returned in the response. It is a comma separated list of field names. If present, only fields whose name is not on the list will be returned. If not present, all fields are returned (unless the 'fields' query parameter is specified). Note: 'fields' must not be specified if 'excludeFields' is specified.
• excludeLinks: string
  The 'excludeLinks' query parameter is used to restrict which links are returned in the response. It is a comma separated list of link relationship names. If present, only links whose relationship name is not on the list will be returned. If not present, all links are returned (unless the 'links' query parameter is specified). Note: 'links' must not be specified if 'excludeLinks' is specified.
• fields: string
  The 'fields' query parameter is used to restrict which fields are returned in the response. It is a comma separated list of field names. If present, only fields with matching names are returned. If not present, all fields are returned (unless the 'excludeFields' query parameter is specified). Note: 'excludeFields' must not be specified if 'fields' is specified.
• links: string
  The 'links' query parameter is used to restrict which links are returned in the response. It is a comma separated list of link relationship names. If present, only links with matching relationship names are returned. If not present, all links are returned (unless the 'excludeLinks' query parameter is specified). Note: 'excludeLinks' must not be specified if 'links' is specified.

Security

• Admin: basic
  Type: basic

  Description: A user in the Admin security role.
• Deployer: basic
  Type: basic

  Description: A user in the Deployer security role.
• Monitor: basic
  Type: basic

  Description: A user in the Monitor security role.
• Operator: basic
  Type: basic

  Description: A user in the Operator security role.

Back to Top

Response

Supported Media Types

• application/json

200 Response

Returns a list of realm entities.

This method can return the following links:

• rel=create-form uri=/management/weblogic/{version}/edit/securityConfiguration/realmCreateForm

  The create form resource for this collection resource.

Body ()

Root Schema : Items

Type: array

Title: Items

Show Source

• Array of: object Realm

{
    "title":"Items",
    "type":"array",
    "items":{
        "$ref":"#/definitions/Realm"
    },
    "description":""
}

Nested Schema : Realm

Type: object

Show Source

• adjudicatorTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Adjudication providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultAdjudicator. Use this method to find the available types to pass to createAdjudicator

• auditorTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Auditing providers that may be created in this security realm, for example, weblogic.security.providers.audit.DefaultAuditor. Use this method to find the available types to pass to createAuditor

• authenticationProviderTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Authentication providers that may be created in this security realm, for example, weblogic.security.providers.authentication.DefaultAuthenticator. Use this method to find the available types to pass to createAuthenticationProvider

• authMethods: string

  Returns a comma separated string of authentication methods that should be used when the Web application specifies "REALM" as its auth-method. The authentication methods will be applied in order in which they appear in the list.

• authorizerTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Authorization providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultAuthorizer. Use this method to find the available types to pass to createAuthorizer

• autoRestartOnNonDynamicChanges: boolean

  Specifies whether the Realm will be auto-restarted if non-dynamic changes are made to the realm or providers within the realm.

• certPathBuilder: array Cert Path Builder Reference
  Title: Cert Path Builder Reference

  Contains the cert path builder reference.

  Returns the CertPath Builder provider in this security realm that will be used by the security system to build certification paths. Returns null if none has been selected. The provider will be one of this security realm's CertPathProviders

  Constraints

  • restart required
• certPathProviderTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Certification Path providers that may be created in this security realm, for example, weblogic.security.providers.pk.WebLogicCertPathProvider. Use this method to find the available types to pass to createCertPathProvider

• combinedRoleMappingEnabled: boolean
  Default Value: true

  Determines how the role mappings in the Enterprise Application, Web application, and EJB containers interact. This setting is valid only for Web applications and EJBs that use the Advanced security model and that initialize roles from deployment descriptors.

  When enabled:

  • Application role mappings are combined with EJB and Web application mappings so that all principal mappings are included. The Security Service combines the role mappings with a logical OR operator.

  • If one or more policies in the web.xml file specify a role for which no mapping exists in the weblogic.xml file, the Web application container creates an empty map for the undefined role (that is, the role is explicitly defined as containing no principal). Therefore, no one can access URL patterns that are secured by such policies.

  • If one or more policies in the ejb-jar.xml file specify a role for which no mapping exists in the weblogic-ejb-jar.xml file, the EJB container creates an empty map for the undefined role (that is, the role is explicitly defined as containing no principal). Therefore, no one can access methods that are secured by such policies.

  When disabled:

  • Role mappings for each container are exclusive to other containers unless defined by the descriptor element.

  • If one or more policies in the web.xml file specify a role for which no role mapping exists in the weblogic.xml file, the Web application container assumes that the undefined role is the name of a principal. It therefore maps the assumed principal to the role name. For example, if the web.xml file contains the following stanza in one of its policies:

    
PrivilegedUser


    but, if the weblogic.xml file has no role mapping for PrivilegedUser, then the Web application container creates an in-memory mapping that is equivalent to the following stanza:

    
PrivilegedUser
PrivilegedUser


  • Role mappings for EJB methods must be defined in the weblogic-ejb-jar.xml file. Role mappings defined in the other containers are not used unless defined by the descriptor element.

  Note:

  For all applications previously deployed in version 8.1 and upgraded to version 9.x, the combining role mapping is disabled by default.

• credentialMapperTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Credential Mapping providers that may be created in this security realm, for example, weblogic.security.providers.credentials.DefaultCredentialMapper. Use this method to find the available types to pass to createCredentialMapper

• delegateMBeanAuthorization: boolean
  Default Value: false

  Configures the WebLogic Server MBean servers to use the security realm's Authorization providers to determine whether a JMX client has permission to access an MBean attribute or invoke an MBean operation.

  You can continue to use WebLogic Server's default security settings or modify the defaults to suit your needs.

  If you do not delegate authorization to the realm's Authorization providers, the WebLogic MBean servers allow access only to the four default security roles (Admin, Deployer, Operator, and Monitor) and only as specified by WebLogic Server's default security settings.

  Constraints

  • secure default : true
• deployableProviderSynchronizationEnabled: boolean
  Default Value: false

  Specifies whether synchronization for deployable Authorization and Role Mapping providers is enabled.

  The Authorization and Role Mapping providers may or may not support parallel security policy and role modification, respectively, in the security provider database. If the security providers do not support parallel modification, the WebLogic Security Framework enforces a synchronization mechanism that results in each application and module being placed in a queue and deployed sequentially.

• deployableProviderSynchronizationTimeout: integer(int32)
  Default Value: 60000

  Returns the timeout value, in milliseconds, for the deployable security provider synchronization operation. This value is only used if DeployableProviderSynchronizationEnabled is set to true

• enableWebLogicPrincipalValidatorCache: boolean
  Default Value: true

  Returns whether the WebLogic Principal Validator caching is enabled.

  The Principal Validator is used by Oracle supplied authentication providers and may be used by custom authentication providers. If enabled, the default principal validator will cache WebLogic Principal signatures.

• identityAssertionCacheEnabled: boolean
  Default Value: true

  Returns whether the Identity Assertion cache is enabled.

• identityAssertionCacheTTL: integer(int32)
  Minimum Value: 0

  Default Value: 300

  Returns the time-to-live (TTL), in seconds, of the Identity Assertion cache. This value is used only if IdentityAssertionCacheEnabled is set to true

• identityAssertionDoNotCacheContextElements: array Items
  Title: Items

  Returns the names of the ContextElements that are not stored in the Identity Assertion cache because these elements are present in the ContextHandler of the requests. This value is used only if IdentityAssertionCacheEnabled is set to true

• identityAssertionHeaderNamePrecedence: array Items
  Title: Items

  Obtain an ordered list of token type names used for Identity Assertion with HTTP request headers.

  The list determines the precedence order when multiple HTTP headers are present in an HTTP request based on the list of active token types maintained on the configured Authentication providers.

• managementIdentityDomain: string

  Sets the Management Identity Domain value for the realm.

• maxWebLogicPrincipalsInCache: integer(int32)
  Default Value: 500

  Returns the maximum size of the LRU cache for holding WebLogic Principal signatures. This value is only used if EnableWebLogicPrincipalValidatorCache is set to true

• name: string
  Read Only: true

  Default Value: Realm

  The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration.

• passwordValidatorTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Password Validator providers that may be created in this security realm, for example, com.bea.security.providers.authentication.passwordvalidator.SystemPasswordValidator. Use this method to find the available types to pass to createPasswordValidator

• retireTimeoutSeconds: integer(int32)
  Minimum Value: 1

  Default Value: 60

  Specifies the retire timeout for a realm that is restarted. The old realm will be shutdown after the specified timeout period has elapsed.

• roleMapperTypes: array Items
  Title: Items

  Read Only: true

  Returns the types of Role Mapping providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultRoleMapper. Use this method to find the available types to pass to createRoleMapper

• securityDDModel: string
  Default Value: DDOnly

  Allowed Values: [ "DDOnly", "CustomRoles", "CustomRolesAndPolicies", "Advanced" ]

  Specifies the default security model for Web applications or EJBs that are secured by this security realm. You can override this default during deployment.

  Note: If you deploy a module by modifying the domain's config.xml file and restarting the server, and if you do not specify a security model value for the module in config.xml, the module is secured with the default value of the AppDeploymentMBean SecurityDDModel attribute (see weblogic.management.configuration.AppDeploymentMBean#getSecurityDDModel() getSecurityDDModel).

  Choose one of these security models:

  • Deployment Descriptors Only (DDOnly)

    • For EJBs and URL patterns, this model uses only the roles and policies in the J2EE deployment descriptors (DD); the Administration Console allows only read access for this data. With this model, EJBs and URL patterns are not protected by roles and policies of a broader scope (such as a policy scoped to an entire Web application). If an EJB or URL pattern is not protected by a role or policy in the DD, then it is unprotected: anyone can access it.

    • For application-scoped roles in an EAR, this model uses only the roles defined in the WebLogic Server DD; the Administration Console allows only read access for this data. If the WebLogic Server DD does not define roles, then there will be no such scoped roles defined for this EAR.

    • For all other types of resources, you can use the Administration Console to create roles or policies. For example, with this model, you can use the Administration Console to create application-scoped policies for an EAR.

    • Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.

  • Customize Roles Only (CustomRoles)

    • For EJBs and URL patterns, this model uses only the policies in the J2EE deployment descriptors (DD). EJBs and URL patterns are not protected by policies of a broader scope (such as a policy scoped to an entire Web application). This model ignores any roles defined in the DDs; an administrator completes the role mappings using the Administration Console.

    • For all other types of resources, you can use the Administration Console to create roles or policies. For example, with this model, you can use the Administration Console to create application-scoped policies or roles for an EAR.

    • Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.

  • Customize Roles and Policies (CustomRolesAndPolicies)

    • Ignores any roles and policies defined in deployment descriptors. An administrator uses the Administration Console to secure the resources.

    • Performs security checks for all URLs or EJB methods in the module.

    • Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.

  • Advanced (Advanced)

    You configure how this model behaves by setting values for the following options:

    • When Deploying Web Applications or EJBs

      Note: When using the WebLogic Scripting Tool or JMX APIs, there is no single MBean attribute for this setting. Instead, you must set the values for the DeployPolicyIgnored and DeployRoleIgnored attributes of RealmMBean

    • Check Roles and Policies (FullyDelegateAuthorization)

    • Combined Role Mapping Enabled (CombinedRoleMappingEnabled)

    You can change the configuration of this model. Any changes immediately apply to all modules that use the Advanced model. For example, you can specify that all modules using this model will copy roles and policies from their deployment descriptors into the appropriate provider databases upon deployment. After you deploy all of your modules, you can change this behavior to ignore roles and policies in deployment descriptors so that when you redeploy modules they will not re-copy roles and policies.

    Note: Prior to WebLogic Server version 9.0 the Advanced model was the only security model available. Use this model if you want to continue to secure EJBs and Web Applications as in releases prior to 9.0.

• validateDDSecurityData: boolean
  Default Value: false

  Not used in this release.

{
    "type":"object",
    "properties":{
        "adjudicatorTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Adjudication providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultAdjudicator</code>. Use this method to find the available types to pass to <code>createAdjudicator</code></p>"
        },
        "auditorTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Auditing providers that may be created in this security realm, for example, <code>weblogic.security.providers.audit.DefaultAuditor</code>. Use this method to find the available types to pass to <code>createAuditor</code></p>"
        },
        "authMethods":{
            "type":"string",
            "description":"<p>Returns a comma separated string of authentication methods that should be used when the Web application specifies \"REALM\" as its auth-method. The authentication methods will be applied in order in which they appear in the list.</p>"
        },
        "authenticationProviderTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Authentication providers that may be created in this security realm, for example, <code>weblogic.security.providers.authentication.DefaultAuthenticator</code>. Use this method to find the available types to pass to <code>createAuthenticationProvider</code></p>"
        },
        "authorizerTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Authorization providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultAuthorizer</code>. Use this method to find the available types to pass to <code>createAuthorizer</code></p>"
        },
        "autoRestartOnNonDynamicChanges":{
            "type":"boolean",
            "description":"<p>Specifies whether the Realm will be auto-restarted if non-dynamic changes are made to the realm or providers within the realm.</p>"
        },
        "certPathBuilder":{
            "x-weblogic-restartRequired":true,
            "title":"Cert Path Builder Reference",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"Contains the cert path builder reference. <p>Returns the CertPath Builder provider in this security realm that will be used by the security system to build certification paths.  Returns null if none has been selected.  The provider will be one of this security realm's <code>CertPathProviders</code></p><p><h5>Constraints</h5></p><ul><li>restart required</li></ul>"
        },
        "certPathProviderTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Certification Path providers that may be created in this security realm, for example, <code>weblogic.security.providers.pk.WebLogicCertPathProvider</code>. Use this method to find the available types to pass to <code>createCertPathProvider</code></p>"
        },
        "combinedRoleMappingEnabled":{
            "default":true,
            "type":"boolean",
            "description":"<p>Determines how the role mappings in the Enterprise Application, Web application, and EJB containers interact. This setting is valid only for Web applications and EJBs that use the Advanced security model and that initialize roles from deployment descriptors.</p><p>When enabled:</p><ul><li><p>Application role mappings are combined with EJB and Web application mappings so that all principal mappings are included. The Security Service combines the role mappings with a logical <code>OR</code> operator.</p></li><li><p>If one or more policies in the <code>web.xml</code> file specify a role for which no mapping exists in the <code>weblogic.xml</code> file, the Web application container creates an empty map for the undefined role (that is, the role is explicitly defined as containing no principal). Therefore, no one can access URL patterns that are secured by such policies.</p></li><li><p>If one or more policies in the <code>ejb-jar.xml</code> file specify a role for which no mapping exists in the <code>weblogic-ejb-jar.xml</code> file, the EJB container creates an empty map for the undefined role (that is, the role is explicitly defined as containing no principal). Therefore, no one can access methods that are secured by such policies.</p></li></ul><p>When disabled:</p><ul><li><p>Role mappings for each container are exclusive to other containers unless defined by the <code><externally-defined></code> descriptor element.</p></li><li><p>If one or more policies in the <code>web.xml</code> file specify a role for which no role mapping exists in the <code>weblogic.xml</code> file, the Web application container assumes that the undefined role is the name of a principal. It therefore maps the assumed principal to the role name. For example, if the <code>web.xml</code> file contains the following stanza in one of its policies:</p><p><code><auth-constraint><br> <role-name>PrivilegedUser</role-name><br> </auth-constraint></code></p><p>but, if the <code>weblogic.xml</code> file has no role mapping for <code>PrivilegedUser</code>, then the Web application container creates an in-memory mapping that is equivalent to the following stanza:</p><p><code><security-role-assignment><br> <role-name>PrivilegedUser</role-name><br> <principal-name>PrivilegedUser</principal-name><br> </security-role-assignment></code></p></li><li><p>Role mappings for EJB methods must be defined in the <code>weblogic-ejb-jar.xml</code> file. Role mappings defined in the other containers are not used unless defined by the <code><externally-defined></code> descriptor element.</p></li></ul><dl><dt>Note:</dt><dd><p>For all applications previously deployed in version 8.1 and upgraded to version 9.x, the combining role mapping is disabled by default.</p></dd></dl>"
        },
        "credentialMapperTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Credential Mapping providers that may be created in this security realm, for example, <code>weblogic.security.providers.credentials.DefaultCredentialMapper</code>. Use this method to find the available types to pass to <code>createCredentialMapper</code></p>"
        },
        "delegateMBeanAuthorization":{
            "x-weblogic-secureDefault":true,
            "default":false,
            "type":"boolean",
            "description":"<p>Configures the WebLogic Server MBean servers to use the security realm's Authorization providers to determine whether a JMX client has permission to access an MBean attribute or invoke an MBean operation.</p><p>You can continue to use WebLogic Server's default security settings or modify the defaults to suit your needs.</p><p>If you do not delegate authorization to the realm's Authorization providers, the WebLogic MBean servers allow access only to the four default security roles (Admin, Deployer, Operator, and Monitor) and only as specified by WebLogic Server's default security settings.</p><p><h5>Constraints</h5></p><ul><li>secure default : true</li></ul>"
        },
        "deployableProviderSynchronizationEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Specifies whether synchronization for deployable Authorization and Role Mapping providers is enabled.</p><p>The Authorization and Role Mapping providers may or may not support parallel security policy and role modification, respectively, in the security provider database. If the security providers do not support parallel modification, the WebLogic Security Framework enforces a synchronization mechanism that results in each application and module being placed in a queue and deployed sequentially.</p>"
        },
        "deployableProviderSynchronizationTimeout":{
            "default":"60000",
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the timeout value, in milliseconds, for the deployable security provider synchronization operation. This value is only used if <code>DeployableProviderSynchronizationEnabled</code> is set to <code>true</code></p>"
        },
        "enableWebLogicPrincipalValidatorCache":{
            "default":true,
            "type":"boolean",
            "description":"<p>Returns whether the WebLogic Principal Validator caching is enabled.</p><p>The Principal Validator is used by Oracle supplied authentication providers and may be used by custom authentication providers. If enabled, the default principal validator will cache WebLogic Principal signatures.</p>"
        },
        "identityAssertionCacheEnabled":{
            "default":true,
            "type":"boolean",
            "description":"<p>Returns whether the Identity Assertion cache is enabled.</p>"
        },
        "identityAssertionCacheTTL":{
            "default":"300",
            "minimum":"0",
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the time-to-live (TTL), in seconds, of the Identity Assertion cache. This value is used only if <code>IdentityAssertionCacheEnabled</code> is set to <code>true</code></p>"
        },
        "identityAssertionDoNotCacheContextElements":{
            "default":[
            ],
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the names of the ContextElements that are not stored in the Identity Assertion cache because these elements are present in the ContextHandler of the requests. This value is used only if <code>IdentityAssertionCacheEnabled</code> is set to <code>true</code></p>"
        },
        "identityAssertionHeaderNamePrecedence":{
            "default":null,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Obtain an ordered list of token type names used for Identity Assertion with HTTP request headers.</p><p>The list determines the precedence order when multiple HTTP headers are present in an HTTP request based on the list of active token types maintained on the configured Authentication providers.</p>"
        },
        "managementIdentityDomain":{
            "type":"string",
            "description":"<p>Sets the Management Identity Domain value for the realm.</p>"
        },
        "maxWebLogicPrincipalsInCache":{
            "default":"500",
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the maximum size of the LRU cache for holding WebLogic Principal signatures. This value is only used if <code>EnableWebLogicPrincipalValidatorCache</code> is set to <code>true</code></p>"
        },
        "name":{
            "readOnly":true,
            "default":"Realm",
            "type":"string",
            "description":"<p>The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration.</p>"
        },
        "passwordValidatorTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Password Validator providers that may be created in this security realm, for example, <code>com.bea.security.providers.authentication.passwordvalidator.SystemPasswordValidator</code>. Use this method to find the available types to pass to <code>createPasswordValidator</code></p>"
        },
        "retireTimeoutSeconds":{
            "default":"60",
            "minimum":"1",
            "type":"integer",
            "format":"int32",
            "description":"<p>Specifies the retire timeout for a realm that is restarted. The old realm will be shutdown after the specified timeout period has elapsed.</p>"
        },
        "roleMapperTypes":{
            "readOnly":true,
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Returns the types of Role Mapping providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultRoleMapper</code>. Use this method to find the available types to pass to <code>createRoleMapper</code></p>"
        },
        "securityDDModel":{
            "default":"DDOnly",
            "enum":[
                "DDOnly",
                "CustomRoles",
                "CustomRolesAndPolicies",
                "Advanced"
            ],
            "type":"string",
            "description":"<p>Specifies the default security model for Web applications or EJBs that are secured by this security realm. You can override this default during deployment.</p><p><b>Note:</b> If you deploy a module by modifying the domain's <code>config.xml</code> file and restarting the server, and if you do not specify a security model value for the module in <code>config.xml</code>, the module is secured with the default value of the <code>AppDeploymentMBean SecurityDDModel</code>  attribute (see weblogic.management.configuration.AppDeploymentMBean#getSecurityDDModel() getSecurityDDModel).</p><p>Choose one of these security models:</p><ul><li><p><code>Deployment Descriptors Only (DDOnly)</code></p><ul><li><p>For EJBs and URL patterns, this model uses only the roles and policies in the J2EE deployment descriptors (DD); the Administration Console allows only read access for this data. With this model, EJBs and URL patterns are not protected by roles and policies of a broader scope (such as a policy scoped to an entire Web application). If an EJB or URL pattern is not protected by a role or policy in the DD, then it is unprotected: anyone can access it. </p></li><li><p>For application-scoped <i>roles</i> in an EAR, this model uses only the roles defined in the WebLogic Server DD; the Administration Console allows only read access for this data. If the WebLogic Server DD does not define roles, then there will be no such scoped roles defined for this EAR.</p></li><li><p>For all other types of resources, you can use the Administration Console to create roles or policies. For example, with this model, you can use the Administration Console to create application-scoped <i>policies</i> for an EAR.</p></li><li><p>Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.</p></li></ul></li><li><p><code>Customize Roles Only (CustomRoles)</code></p><ul><li><p>For EJBs and URL patterns, this model uses only the <i>policies</i> in the J2EE deployment descriptors (DD). EJBs and URL patterns are not protected by policies of a broader scope (such as a policy scoped to an entire Web application). This model ignores any <i>roles</i> defined in the DDs; an administrator completes the role mappings using the Administration Console.</p></li><li><p>For all other types of resources, you can use the Administration Console to create roles or policies. For example, with this model, you can use the Administration Console to create application-scoped policies or roles for an EAR.</p></li><li><p>Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.</p></li></ul></li><li><p><code>Customize Roles and Policies (CustomRolesAndPolicies)</code></p><ul><li><p>Ignores any roles and policies defined in deployment descriptors. An administrator uses the Administration Console to secure the resources.</p></li><li><p>Performs security checks for <b>all</b> URLs or EJB methods in the module.</p></li><li><p>Applies for the life of the deployment. If you want to use a different model, you must delete the deployment and reinstall it.</p></li></ul></li><li><p><code>Advanced (Advanced)</code></p><p>You configure how this model behaves by setting values for the following options:</p><ul><li><p><code>When Deploying Web Applications or EJBs</code></p><p><b>Note:</b> When using the WebLogic Scripting Tool or JMX APIs, there is no single MBean attribute for this setting. Instead, you must set the values for the <code>DeployPolicyIgnored</code> and <code>DeployRoleIgnored</code> attributes of <code>RealmMBean</code></p></li><li><p><code>Check Roles and Policies (FullyDelegateAuthorization)</code></p></li><li><p><code>Combined Role Mapping Enabled (CombinedRoleMappingEnabled)</code></p></li></ul><p>You can change the configuration of this model. Any changes immediately apply to all modules that use the Advanced model. For example, you can specify that all modules using this model will copy roles and policies from their deployment descriptors into the appropriate provider databases upon deployment. After you deploy all of your modules, you can change this behavior to ignore roles and policies in deployment descriptors so that when you redeploy modules they will not re-copy roles and policies.</p><p><b>Note:</b> Prior to WebLogic Server version 9.0 the Advanced model was the only security model available. Use this model if you want to continue to secure EJBs and Web Applications as in releases prior to 9.0.</p></li></ul>"
        },
        "validateDDSecurityData":{
            "default":false,
            "type":"boolean",
            "description":"<p>Not used in this release.</p>"
        }
    },
    "description":""
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Adjudication providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultAdjudicator. Use this method to find the available types to pass to createAdjudicator

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Adjudication providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultAdjudicator</code>. Use this method to find the available types to pass to <code>createAdjudicator</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Auditing providers that may be created in this security realm, for example, weblogic.security.providers.audit.DefaultAuditor. Use this method to find the available types to pass to createAuditor

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Auditing providers that may be created in this security realm, for example, <code>weblogic.security.providers.audit.DefaultAuditor</code>. Use this method to find the available types to pass to <code>createAuditor</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Authentication providers that may be created in this security realm, for example, weblogic.security.providers.authentication.DefaultAuthenticator. Use this method to find the available types to pass to createAuthenticationProvider

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Authentication providers that may be created in this security realm, for example, <code>weblogic.security.providers.authentication.DefaultAuthenticator</code>. Use this method to find the available types to pass to <code>createAuthenticationProvider</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Authorization providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultAuthorizer. Use this method to find the available types to pass to createAuthorizer

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Authorization providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultAuthorizer</code>. Use this method to find the available types to pass to <code>createAuthorizer</code></p>"
}

Nested Schema : Cert Path Builder Reference

Type: array

Title: Cert Path Builder Reference

Contains the cert path builder reference.

Returns the CertPath Builder provider in this security realm that will be used by the security system to build certification paths. Returns null if none has been selected. The provider will be one of this security realm's CertPathProviders

Constraints

• restart required

Show Source

• Array of: string

{
    "x-weblogic-restartRequired":true,
    "title":"Cert Path Builder Reference",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"Contains the cert path builder reference. <p>Returns the CertPath Builder provider in this security realm that will be used by the security system to build certification paths.  Returns null if none has been selected.  The provider will be one of this security realm's <code>CertPathProviders</code></p><p><h5>Constraints</h5></p><ul><li>restart required</li></ul>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Certification Path providers that may be created in this security realm, for example, weblogic.security.providers.pk.WebLogicCertPathProvider. Use this method to find the available types to pass to createCertPathProvider

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Certification Path providers that may be created in this security realm, for example, <code>weblogic.security.providers.pk.WebLogicCertPathProvider</code>. Use this method to find the available types to pass to <code>createCertPathProvider</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Credential Mapping providers that may be created in this security realm, for example, weblogic.security.providers.credentials.DefaultCredentialMapper. Use this method to find the available types to pass to createCredentialMapper

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Credential Mapping providers that may be created in this security realm, for example, <code>weblogic.security.providers.credentials.DefaultCredentialMapper</code>. Use this method to find the available types to pass to <code>createCredentialMapper</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Returns the names of the ContextElements that are not stored in the Identity Assertion cache because these elements are present in the ContextHandler of the requests. This value is used only if IdentityAssertionCacheEnabled is set to true

Show Source

• Array of: string

{
    "default":[
    ],
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the names of the ContextElements that are not stored in the Identity Assertion cache because these elements are present in the ContextHandler of the requests. This value is used only if <code>IdentityAssertionCacheEnabled</code> is set to <code>true</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Obtain an ordered list of token type names used for Identity Assertion with HTTP request headers.

The list determines the precedence order when multiple HTTP headers are present in an HTTP request based on the list of active token types maintained on the configured Authentication providers.

Default Value: oracle.doceng.json.BetterJsonNull@58f7544c

Show Source

• Array of: string

{
    "default":null,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Obtain an ordered list of token type names used for Identity Assertion with HTTP request headers.</p><p>The list determines the precedence order when multiple HTTP headers are present in an HTTP request based on the list of active token types maintained on the configured Authentication providers.</p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Password Validator providers that may be created in this security realm, for example, com.bea.security.providers.authentication.passwordvalidator.SystemPasswordValidator. Use this method to find the available types to pass to createPasswordValidator

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Password Validator providers that may be created in this security realm, for example, <code>com.bea.security.providers.authentication.passwordvalidator.SystemPasswordValidator</code>. Use this method to find the available types to pass to <code>createPasswordValidator</code></p>"
}

Nested Schema : Items

Type: array

Title: Items

Read Only: true

Returns the types of Role Mapping providers that may be created in this security realm, for example, weblogic.security.providers.authorization.DefaultRoleMapper. Use this method to find the available types to pass to createRoleMapper

Show Source

• Array of: string

{
    "readOnly":true,
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Returns the types of Role Mapping providers that may be created in this security realm, for example, <code>weblogic.security.providers.authorization.DefaultRoleMapper</code>. Use this method to find the available types to pass to <code>createRoleMapper</code></p>"
}

Back to Top