This chapter includes the following sections:
JAAS enforces access controls based on user identity and is the preferred method of authentication for most WebLogic Server clients. A typical use case is providing authentication to read or write to a file.
For more information about how to implement JAAS authentication, see Using JAAS Authentication in Java Clients in Developing Applications with the WebLogic Security Service.
Note:
The WLS-IIOP client does not support JAAS. See Developing Clients that Use JNDI Authentication.
Learn how to develop clients using JNDI authentication.
Users requiring client certificate authentication (also referred to as two-way SSL authentication) should use JNDI authentication, as described in Using JNDI Authentication in Developing Applications with the WebLogic Security Service.
WebLogic Server provides Secure Sockets Layer (SSL) support for encrypting data transmitted between WebLogic Server clients and servers, Java clients, Web browsers, and other servers. All SSL clients need to specify trust. Trust is a set of CA certificates that specify which trusted certificate authorities are trusted by the client.
In order to establish an SSL connection, RMI clients need to trust the certificate authorities that issued the server's digital certificates. The location of the server's trusted CA certificate is specified when starting the RMI client.
Note:
WebLogic Server's integration with Java Secure Socket Extension (JSSE) does not use the default javax.net.ssl.SSLContext instance or any of the following JVM system properties that define keystore settings:
javax.net.ssl.keyStore
javax.net.ssl.keyStorePassword
javax.net.ssl.keyStoreType
javax.net.ssl.trustStore
javax.net.ssl.trustStorePassword
javax.net.ssl.trustStoreType
By default, all trusted certificate authorities available from the JDK (...\jre\lib\security\cacerts) are trusted by RMI clients. However, if the server's trusted CA certificate is stored in one of the following trust keystores, you need to specify certain command line arguments in order to use the keystore:
Demo Trust—The trusted CA certificates in the demonstration Trust keystore (DemoTrust.jks) are located in the WL_HOME\server\lib directory. In addition, the trusted CAs in the JDK cacerts keystore are trusted. To use the Demo Trust, specify the following command-line argument:
-Dweblogic.security.TrustKeyStore=DemoTrust
Optionally, use the following command-line argument to specify a password for the JDK cacerts trust keystore:
-Dweblogic.security.JavaStandardTrustKeyStorePassPhrase=password
where password is the password for the Java Standard Trust keystore. This password is defined when the keystore is created.
Custom Trust—A trust keystore you create. To use Custom Trust, specify the following command-line arguments.
Specify the fully qualified path to the trust keystore:
-Dweblogic.security.CustomTrustKeyStoreFileName=filename
Specify the type of the keystore:
-Dweblogic.security.CustomTrustKeyStoreType=jks
Optionally, specify the password defined when creating the keystore:
-Dweblogic.security.CustomTrustKeyStorePassPhrase=password
Oracle's keytool utility can also be used to generate a private key, a self-signed digital certificate for WebLogic Server, and a Certificate Signing Request (CSR). For more information about Oracle's keytool utility, see the keytool-Key and Certificate Management Tool description at http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html.
For a tutorial on using keytool to create a client certificate, see section "Creating a Client Certificate for Mutual Authentication" in The Java EE Tutorial, at https://docs.oracle.com/javaee/7/tutorial/security-advanced002.htm#GLIEN.
Note:
When using the keytool utility, the default key pair generation algorithm is DSA. WebLogic Server does not support the use of the Digital Signature Algorithm (DSA). Specify another key pair generation and signature algorithm when using WebLogic Server.
You can find more information about how to implement SSL in Configuring SSL and Configuring Keystores in Administering Security for Oracle WebLogic Server.
Note:
Although JSSE supports Server Name Indication (SNI) in its SSL implementation, WebLogic Server does not support SNI.
WebLogic thin-clients only support two-way SSL by requiring the SSLContext to be provided by the SECURITY_CREDENTIALS property.
WebLogic thin-client applications only support JAAS authentication through the following methods:
To understand how thin-clients support two-way SSLusing SSLContext, see the sample client code below:
Example 14-1 Client Code with sslcontext
.
.
.
System.out.println("Getting initial context");
Hashtable props = new Hashtable();
props.put(Context.INITIAL_CONTEXT_FACTORY,"weblogic.jndi.WLInitialContextFactory");
props.put(Context.PROVIDER_URL,"corbaloc:iiops:" + host + ":" + port +"/NameService");
props.put(Context.SECURITY_PRINCIPAL,"weblogic");
props.put(Context.SECURITY_CREDENTIALS, "password");
//Set the ssl properties through system property
//set the path to the keystore file (one key inside the store)
System.setProperty("javax.net.ssl.keyStore", YOUR-KEY_STORE_FILE_PATH);
//set the keystore pass phrase
System.setProperty("javax.net.ssl.keyStorePassword",YOUR_KEY_STORE_PASS_PHRASE);
//Set the trust store
//set the path to the trust store file
System.setProperty("javax.net.ssl.trustStore",YOUR-TRUST_STORE_FILE_PATH);
//set the trust store pass phrase
System.setProperty("javax.net.ssl.trustStorePassword",YOUR_TRUST_STORE_PASS_PHRASE);
Context ctx = new InitialContext(props);
.
.
.Security samples are optionally provided with the WebLogic Server product. A description of each sample and instructions on how to build, configure, and run a sample, are provided in the package-summary.html file.
The samples are located in the ORACLE_HOME\wlserver\samples\server\examples\src\examples\security directory. You can modify these code examples and reuse them. See Sample Applications and Code Examples in Understanding Oracle WebLogic Server.