Configuring Existing WebLogic Domains

5 Configuring Existing WebLogic Domains

You can use WebLogic Scripting Tool (WLST) both online and offline to update an existing WebLogic domain.

Using WLST Online to Update an Existing WebLogic Domain

WLST online changes to the domain’s editable configuration MBeans use the change management process, which closely resembles a database transaction. Security-provider data operations and runtime management operations follow their own rules, as described in the corresponding sections.

For more information on making and managing configuration changes, see Configuration Change Management Process in Understanding Domain Configuration for Oracle WebLogic Server.

Table 5-1 describes the steps for using WLST online to update an existing WebLogic domain.

Table 5-1 Steps for Updating an Existing WebLogic Domain (Online)

To...	Use this command...	See this section in WLST Command Reference for Oracle WebLogic Server:
Access the edit MBean hierarchy	`edit()` Follow `edit()` with `cd('/')` to select the editable `DomainMBean` at the root.	edit
Obtain a lock on the current configuration To indicate that configuration changes are in process, an exclamation point (!) appears at the end of the WLST command prompt.	`startEdit([waitTimeInMillis], [timeOutInMillis], [exclusive])`	startEdit
Modify the WebLogic domain	Browsing and online editing commands	Browse Commands Editing Commands
(Optional) Validate your edits	`validate()`	validate
Save your changes	`save()`	save
Distribute your changes to the working configuration MBeans on all servers in the WebLogic domain	`activate([timeout], [block])`. Successful activation releases the edit lock.	activate
Alternatively, release the edit lock without activating, discarding unsaved changes. Saved, unactivated changes remain pending.	`stopEdit([defaultAnswer])`	stopEdit
(Optional) Determine if a change you made to an MBean attribute requires you to re-start servers You can use the showChanges command to determine the changes you made to the configuration.	`isRestartRequired([attributeName])`	isRestartRequired

The WLST online script in Example 5-1 connects WLST to an Administration Server, initiates an edit session that creates a Managed Server, saves and activates the change, initiates another edit session, creates a startup class, and targets it to the newly created server.

Example 5-1 Creating a Managed Server

connect("username","password")
edit()
startEdit()
svr = cmo.createServer("managedServer")
svr.setListenPort(8001)
svr.setListenAddress("address")
save()
activate(block="true")

startEdit()
sc = cmo.createStartupClass("my-startupClass")
sc.setClassName("com.bea.foo.bar")
sc.setArguments("foo bar")

# get the server mbean to target it
tBean = getMBean("Servers/managedServer")
if tBean != None:
    print "Found our target"
    sc.addTarget(tBean)
save()
activate(block="true")
disconnect()
exit()

Tracking Configuration Changes

For all changes that are initiated by WLST, you can use the showChanges command, which displays all the changes that you made to the current configuration from the start of the WLST edit session, including any MBean operations that were implicitly performed by the server. See Example 5-2.

Example 5-2 Displaying Changes

connect("username","password")
wls:/mydomain/serverConfig> edit()
wls:/mydomain/edit> startEdit()
Starting an edit session ...
Started edit session, please be sure to save and activate your
changes once you are done.
wls:/mydomain/edit !> cmo.createServer('managed2')
[MBeanServerInvocationHandler]mydomain:Name=managed2,Type=Server
wls:/mydomain/edit !> cd('Servers/managed2')
wls:/mydomain/edit/Servers/managed2 !> cmo.setListenPort(7702)
wls:/mydomain/edit/Servers/managed2 !> cmo.setListenAddress("localhost")
wls:/mydomain/edit/Servers/managed2 !> showChanges()
Changes that are in memory and saved to disc but not yet activated are:

All changes that are made but not yet activated are:
 
MBean Changed : com.bea:Name=mydomain,Type=Domain
Operation Invoked : create
Attribute Modified : Servers
Attributes Old Value : null
Attributes New Value : managed2
Server Restart Required : false
 
 
MBean Changed : com.bea:Name=managed2,Type=Server
Operation Invoked : modify
Attribute Modified : ListenPort
Attributes Old Value : null
Attributes New Value : 7702
Server Restart Required : false

wls:/mydomain/edit/Servers/managed2 !> save()
Saving all your changes ...
Saved all your changes successfully.
wls:/mydomain/edit !> activate()
Activating all your changes, this may take a while ...
The edit lock associated with this edit session is released
once the activation is completed.
Activation completed
wls:/mydomain/edit/Servers/managed2>

Run Example 5-3 after invoking activate() in the current connected WLST session, while in the edit hierarchy, for example after Example 5-2. It retrieves that session’s latest activation task and prints its user, state, and changes. The example does not establish a connection or initiate activation itself. If the current WLST session has not initiated an activation, getActivationTask() returns None.

The getActivationTask function provides information about the activation request and returns the latest ActivationTaskMBean which reflects the state of changes that a user is currently making or made recently in the current WLST session. You invoke the methods that this interface provides to get information about the latest activation task in progress or just completed. For detailed information, see ActivationTaskMBean in the MBean Reference for Oracle WebLogic Server.

Example 5-3 Checking the Activation Task

at = getActivationTask()
changes = at.getChanges()
newstate = at.getState()
print "The user for this Task is "+at.getUser()+ "and the state is:"
print newstate
print "The changes are:"
print changes

Undoing or Canceling Changes

WLST offers two commands to undo or cancel changes:

The undo command reverts all unsaved or unactivated edits.

You specify whether to revert all unactivated edits (including those that have been saved to disk), or all edits made since the last save operation. See undo in WebLogic Scripting Tool Command Reference.
The cancelEdit command releases the edit lock and discards all unsaved changes. See cancelEdit in WLST Command Reference for Oracle WebLogic Server.

Additional Operations and Attributes for Change Management

The standard change-management commands described in the previous section are convenience commands for invoking operations in the ConfigurationManagerMBean. In addition to these operations, the ConfigurationManagerMBean contains attributes and operations that describe edit sessions. For detailed information, see ConfigurationManagerMBean in the MBean Reference for Oracle WebLogic Server.

To access this MBean, use the WLST getConfigManager command. See getConfigManager in WLST Command Reference for Oracle WebLogic Server.

The WLST online script in Example 5-4 connects WLST to a server instance as an administrator, checks if another user holds the current edit lock, then cancels the configuration edits. The script also purges all the completed activation tasks. You can use this script to make a fresh start to edit changes, but you should verify that the changes made by other editors are not needed.

Example 5-4 Using the Configuration Manager

connect('adminusername', 'adminpassword')
edit()
cmgr = getConfigManager()
currentEditor = cmgr.getCurrentEditor()
if currentEditor is not None and not cmgr.isEditor():
    cmgr.cancelEdit()
cmgr.purgeCompletedActivationTasks()

Using WLST Offline to Update an Existing WebLogic Domain

You can update an existing WebLogic domain using WLST offline.

Note:

Oracle recommends that you do not use WLST offline to manage the configuration of an active WebLogic domain. Offline edits are ignored by running servers and can be overwritten by JMX clients such as WLST online or the WebLogic Remote Console.

The commands in the following table are used to read an existing domain, update the domain as needed, and close the domain in offline mode. During this process, if a connection factory is targeted to a subdeployment, after running the updateDomain command and restarting the domain, default-targeting-enabled is set to true for the connection factory.

To update an existing WebLogic domain using WLST offline, perform the steps described in Table 5-2.

Table 5-2 Steps for Updating an Existing WebLogic Domain (Offline)

To...	Use this command...	See ...
Open an existing WebLogic domain for update	`readDomain(domainDirName)`	readDomain in WLST Command Reference for Oracle WebLogic Server
Extend the current WebLogic domain (optional)	`selectTemplate(templateName)` `loadTemplates()`	selectTemplate and loadTemplates in WLST Command Reference for Oracle WebLogic Server
Modify the WebLogic domain (optional)	Browsing and editing commands	Browsing Information About the Configuration Hierarchy (Offline) Editing a WebLogic Domain (Offline)
Save the WebLogic domain	`updateDomain()`	updateDomain in WLST Command Reference for Oracle WebLogic Server
Close the WebLogic domain	`closeDomain()`	closeDomain in WLST Command Reference for Oracle WebLogic Server

The WLST Offline script in Example 5-5 disables the SSL/TLS requirements that are typically required when a domain is in secured production mode.

This WLST offline example disables the domain administration port, enables the domain-wide default for plain-text listen ports, disables the domain-wide default for SSL/TLS, and disables secure replication on the domain’s clusters. Explicit server-level listen-port or SSL settings can override the corresponding domain-wide defaults.

Example 5-5 Disabling SSL/TLS on a Domain in Secured Production Mode

readDomain('DOMAIN_HOME')
cd('/')
cmo.setAdministrationPortEnabled(false)
cmo.setListenPortEnabled(true)
cmo.setSSLEnabled(false)
cd('/Clusters')
redirect('/dev/null','false')
clusters=ls(returnMap='true')
stopRedirect()
 
for cls in clusters:
     cd('/Clusters/' + cls)
     # Disable secure replication
     cmo.setSecureReplicationEnabled(false)
 
updateDomain()
closeDomain()

Managing Security Data (WLST Online)

You can manage security data, such as authentication providers, using WLST online.

In the WebLogic Security Service, an Authentication provider is the software component that proves the identity of users or system processes. An Authentication provider also remembers, transports, and makes that identity information available to various components of a system when needed.

A security realm can use different types of Authentication providers to manage different sets of users and groups. (See Authentication Providers in Developing Security Providers for Oracle WebLogic Server. You can use WLST to invoke operations on the following types of Authentication providers:

The default WebLogic Authentication provider, represented by weblogic.security.providers.authentication.DefaultAuthenticatorMBean, supports user and group management through its user and group capability interfaces.
Custom Authentication providers whose MBeans implement the corresponding optional user or group management interfaces. See SSPI MBean Quick Reference in Developing Security Providers for Oracle WebLogic Server.

The base AuthenticationProviderMBean interface does not declare every user and group operation. Each task below requires a provider that implements the interface named for that task. The default WebLogic Authentication provider supports the interfaces used in these examples.

For information about additional tasks that the AuthenticationProvider MBeans support, see AuthenticationProviderMBean in the MBean Reference for Oracle WebLogic Server.

Note:

It is possible to use WLST offline to edit certain types of security data, such as authentication providers. However, we recommend that you use WLST online whenever possible and only use WLST offline to edit security data if required by constraints in your environment .

The following sections describe basic tasks for managing users and groups using WLST.

Determining If You Need to Access the Edit Hierarchy

If you are using WLST to change the configuration of a security MBean, you must access the edit hierarchy and start an edit session. For example, if you change the value of the LockoutThreshold attribute in UserLockoutManagerMBean, you must be in the edit hierarchy.

If you invoke security provider operations to add, modify, or remove data in a security provider data store, WLST does not allow you to be in the edit hierarchy. Instead, invoke these commands from the serverConfig or domainConfig hierarchy. For example, you cannot invoke the createUser operation in an AuthenticatorMBean MBean from the edit hierarchy. WLST enforces this restriction to prevent the possibility of incompatible changes. For example, an edit session could contain an unactivated change that removes a security feature and will invalidate modifications to the provider's data.

Creating a User

To create a user, invoke createUser on an Authentication provider that implements UserEditorMBean. See the createUser method of the UserEditorMBean in the MBean Reference for Oracle WebLogic Server.

The method requires three parameters: user name, password, and description. The password must satisfy the Authentication provider’s requirements and the password-validation policy configured for the security realm. For the default provider, the minimum password length is configurable; additional requirements depend on the configured password validators.

username password user-description

WLST cannot invoke this command from the edit hierarchy, but it can invoke the command from the serverConfig or domainConfig hierarchy.

The following WLST online script invokes createUser on the default authentication provider.

Example 5-6 Creating a User

This example assumes that WLST is already connected to the Administration Server and that the default realm contains an Authentication provider named DefaultAuthenticator. Replace example user and group names with names applicable to your realm.

from getpass import getpass
from weblogic.management.security.authentication import UserEditorMBean

print "Creating a user ..."
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
atnr = realm.lookupAuthenticationProvider('DefaultAuthenticator')
newPassword = getpass('Password for new_user: ')
atnr.createUser('new_user', newPassword, 'new_user')
print "Created user successfully"

Adding a User to a Group

To add a user to a group, invoke addMemberToGroup on an Authentication provider that implements GroupEditorMBean. See the addMemberToGroup method in the MBean Reference for Oracle WebLogic Server.

The method requires two input parameters:

groupname username

WLST cannot invoke this command from the edit hierarchy, but it can invoke the command from the serverConfig or domainConfig hierarchy.

The following WLST online script invokes addMemberToGroup on the default Authentication Provider. For information on how to run this script, see Invoking WLST.

Example 5-7 Adding a User to a Group

from weblogic.management.security.authentication import GroupEditorMBean

print "Adding a user ..."
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
atnr = realm.lookupAuthenticationProvider('DefaultAuthenticator')
atnr.addMemberToGroup('Administrators','my_user')
print "Done adding a user"

Verifying Whether a User Is a Member of a Group

To test group membership, invoke isMember on an Authentication provider that implements GroupReaderMBean; GroupEditorMBean extends this interface. See the isMember method in the MBean Reference for Oracle WebLogic Server.

The method requires three input parameters:

groupname username boolean

where boolean specifies whether the command searches within child groups. If you specify true, the command returns true if the member belongs to the group that you specify or to any of the groups contained within that group.

WLST cannot invoke this command from the edit hierarchy, but it can invoke the command from the serverConfig or domainConfig hierarchy.

The following WLST online script invokes isMember on the default Authentication Provider. For information on how to run this script, see Invoking WLST.

Example 5-8 Verifying Whether a User is a Member of a Group

from weblogic.management.security.authentication import GroupEditorMBean
user = "my_user"
print "Checking if "+user+ " is a Member of a group ... "
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
atnr = realm.lookupAuthenticationProvider('DefaultAuthenticator')
if atnr.isMember('Administrators',user,true) == 0:
  print user+ " is not member of Administrators"
else:
  print user+ " is a member of Administrators"

Listing Groups to Which a User Belongs

To list groups containing a user or group, invoke listMemberGroups on an Authentication provider that implements MemberGroupListerMBean. See the listMemberGroups method of the MemberGroupListerMBean in the MBean Reference for Oracle WebLogic Server.

The method requires one input parameter:

memberUserOrGroupName

where memberUserOrGroupName specifies the name of an existing user or a group.

WLST cannot invoke this command from the edit hierarchy, but it can invoke the command from the serverConfig or domainConfig hierarchy.

The following WLST online script invokes listMemberGroups on the default Authentication provider. For information on how to run this script, see Invoking WLST.

Example 5-9 Listing Groups to Which a User Belongs

from weblogic.management.security.authentication import MemberGroupListerMBean

print "Listing the member groups ..."
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
atnr = realm.lookupAuthenticationProvider('DefaultAuthenticator')
cursor = atnr.listMemberGroups('my_user')
try:
    while atnr.haveCurrent(cursor):
        print atnr.getCurrentName(cursor)
        atnr.advance(cursor)
finally:
    atnr.close(cursor)

The method returns a cursor value (for example, Cursor_16), which refers to a list of names. The NameLister.haveCurrent, getCurrentName, and advance operations iterate through the returned list and retrieve the name to which the current cursor position refers. See NameListerMBean in the MBean Reference for Oracle WebLogic Server.

Listing Users and Groups in a Security Realm

To list users or groups, use a provider that implements UserReaderMBean or GroupReaderMBean, respectively, and iterate the returned cursor through its inherited NameListerMBean operations.

The GroupReaderMBean.listGroups and UserReaderMBean.listUsers methods take two input parameters: a pattern of user or group names to search for, and the maximum number of names that you want to retrieve.

Because a security realm can contain thousands (or more) of user and group names that match the pattern, the methods return a cursor, which refers to a list of names.

See the listGroups operation in the GroupReaderMBean and the listUsers operation in the UserReaderMBean in the MBean Reference for Oracle WebLogic Server.
The NameLister.haveCurrent, getCurrentName, and advance operations iterate through the returned list and retrieve the name to which the current cursor position refers. See NameListerMBean in the MBean Reference for Oracle WebLogic Server.
The NameLister.close operation releases any server-side resources that are held on behalf of the list.

WLST cannot invoke these commands from the edit hierarchy, but it can invoke them from the serverConfig or domainConfig hierarchy.

Example 5-10 lists users and groups separately for each Authentication provider that supports the corresponding reader interface. It does not associate users with their group memberships; use Example 5-9 to list a user’s groups.

Example 5-10 Listing Users and Groups

For information on how to run this script, see Invoking WLST.

from weblogic.management.security.authentication import UserReaderMBean
from weblogic.management.security.authentication import GroupReaderMBean

serverConfig()
cd('/')
realm=cmo.getSecurityConfiguration().getDefaultRealm()
atns = realm.getAuthenticationProviders()
for i in atns:
  if isinstance(i,UserReaderMBean):
    userReader = i
    cursor = i.listUsers("*",0)
    print 'Users in realm '+realm.getName()+' are: '
    while userReader.haveCurrent(cursor):
      print userReader.getCurrentName(cursor)
      userReader.advance(cursor)
    userReader.close(cursor)

for i in atns:
  if isinstance(i,GroupReaderMBean):
    groupReader = i
    cursor = i.listGroups("*",0)
    print 'Groups in realm are: '
    while groupReader.haveCurrent(cursor):
      print groupReader.getCurrentName(cursor)
      groupReader.advance(cursor)
    groupReader.close(cursor)

Changing a Password

To change a user’s password, invoke changeUserPassword on an Authentication provider that implements UserPasswordEditorMBean. See the changeUserPassword method in the MBean Reference for Oracle WebLogic Server.

WLST cannot invoke this command from the edit hierarchy, but it can invoke the command from the serverConfig or domainConfig hierarchy.

The following WLST online script invokes changeUserPassword on the default Authentication Provider. For information on how to run this script, see Invoking WLST.

Example 5-11 Changing a Password

from getpass import getpass
from weblogic.management.security.authentication import UserPasswordEditorMBean

print "Changing password ..."
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
atnr = realm.lookupAuthenticationProvider('DefaultAuthenticator')
oldPassword = getpass('Current password for my_user: ')
newPassword = getpass('New password for my_user: ')
atnr.changeUserPassword('my_user', oldPassword, newPassword)
print "Changed password successfully"

Protecting User Accounts in a Security Realm

UserLockoutManagerMBean configures user lockout behavior. Lockout is enabled by default, with a default LockoutThreshold of 5 and LockoutDuration of 30 minutes. You can configure whether lockout is enabled, the invalid-login threshold and observation interval, and the duration of a lockout to suit the domain’s requirements.

The UserLockoutManagerRuntimeMBean provides a set of attributes for collecting lockout statistics, and operations for managing user lockouts. For example, you can get the number of users currently locked out, get the number of invalid login attempts since the server was started, or clear the lockout on a user account.

For more information about lockout configuration, see the UserLockoutManagerMBean interface in the MBean Reference for Oracle WebLogic Server. For information about collecting lockout statistics and performing lockout operations, see the UserLockoutManagerRuntimeMBean interface in the MBean Reference for Oracle WebLogic Server

To change lockout configuration, connect to the Administration Server, enter the edit hierarchy, start an edit session, make the configuration changes, and save and activate them. To query lockout runtime statistics or invoke clearLockout, use UserLockoutManagerRuntimeMBean in the runtime hierarchy; these runtime operations do not require an edit session.

The following examples configure UserLockoutManagerMBean and invoke a runtime operation on UserLockoutManagerRuntimeMBean, respectively.

Set Consecutive Invalid Login Attempts

The following WLST online script sets the number of consecutive invalid login attempts before a user account is locked out. For information on how to run this script, see Invoking WLST.

Example 5-12 Setting Consecutive Invalid Login Attempts

from weblogic.management.security.authentication import UserLockoutManagerMBean

edit()
startEdit()
cd('/')

#You have two choices for getting a user lockout manager to configure
# 1 - to configure the default realm's UserLockoutManager:
ulm=cmo.getSecurityConfiguration().getDefaultRealm().getUserLockoutManager()

# 2 - to configure another realm's UserLockoutManager:
#ulm=cmo.getSecurityConfiguration().lookupRealm("anotherRealm").getUserLockoutManager()

ulm.setLockoutThreshold(3)
save()
activate()

Unlock a User Account

The following WLST online script unlocks a user account. For information on how to run this script, see Invoking WLST.

Example 5-13 Unlocking a User Account

from weblogic.management.runtime import UserLockoutManagerRuntimeMBean

serverRuntime()
cd('/')
ulm=cmo.getServerSecurityRuntime().getDefaultRealmRuntime().getUserLockoutManagerRuntime()
#note1 : You can only manage user lockouts for the default realm starting from 
#when the server was booted (versus other non-active realms).
#note2 : If the default realm's user lockout manager's LockoutEnabled attribute 
#is false, then the user lockout manager's runtime MBean will be null.
#That is, you can only manage user lockouts in the default realm if its user 
#lockout manager is enabled.

if ulm != None:
  ulm.clearLockout("myuser")

Restricting User Access to Management Applications

Use the WebLogic Restrict User Management Access servlet filter, RestrictUserManagementAccess to control which users have access to WebLogic Remote Console and other RESTful management resources.

When enabled, if the WebLogic Restrict User Management Access Servlet filter detects that an HTTP request to a RESTful management application originates from a restricted user, it blocks user access and terminates the user session.

The WebLogic Restrict User Management Access Servlet filter is disabled by default.

For more information, see Restrict User Access to Management Applications in Administering Security for Oracle WebLogic Server.

To block a user, add a regular expression pattern that matches the user's principal name to the WebAppContainerMBean.RestrictUserManagementAccessPatterns attribute. Entries in the RestrictUserManagementAccessPatterns attribute must consist of a string array of regular expressions that follow the Java Pattern syntax specification. For example: ["^.*BootUser$", "^svc_.*$", "^automation_.*$", "^local123$"].

Note:

This filter only blocks users from accessing RESTful management applications. They can still access WLST unless you implement other security access controls specific to WLST.

Example 5-14 demonstrates how to enable the WebLogic Restrict User Management Access Servlet filter by specifying a username pattern in the WebAppContainerMBean.RestrictUserManagementAccessPatterns attribute.

Example 5-14 Restricting User Access to Management Applications

connect('username','password','t3://adminServerHost:adminServerPort')
edit()
startEdit()
cd('/')
patterns = jarray.array([
    '^.*BootUser$', '^svc_.*$', '^automation_.*$', '^local123$'
], String)
cmo.getWebAppContainer().setRestrictUserManagementAccessPatterns(patterns)
save()
activate()
exit()

Configuring Additional LDAP Authentication Providers

In some cases, such as when installing some Oracle Fusion Middleware products, you must add an additional external LDAP authentication providers to the WebLogic Server security providers. This can be done either by using the WebLogic Remote Console (see Configure an Authentication or Identity Assertion Provider in Oracle WebLogic Remote Console Online Help) or by using WLST.

Example 5-15 shows how to use WLST to add an Oracle Internet Directory (OID) authentication provider. To add other types of LDAP authentication providers, substitute the appropriate class type in the createAuthenticationProvider command, as shown in Table 5-3.

Note:

For important information about switching LDAP authentication providers if the corresponding LDAP server will contain the user or users who start the domain, see Requirements for Using an LDAP Authentication Provider in Administering Security for Oracle WebLogic Server.

Example 5-15 Adding an Authentication Provider

This example adds an OID provider to the default realm, makes it first in the invocation order, and sets its control flag and the existing DefaultAuthenticator control flag to SUFFICIENT. All other providers retain their existing relative order and settings. The example uses the OID provider’s default LDAP schema mappings.

import jarray
from getpass import getpass
from weblogic.management.security.authentication import AuthenticationProviderMBean

adminURL = raw_input('Administration Server URL: ')
adminUser = raw_input('Administrator user name: ')
adminPassword = getpass('Administrator password: ')
providerName = raw_input('New OID provider name: ')
ldapHost = raw_input('OID host: ')
ldapPort = int(raw_input('OID port: '))
ldapPrincipal = raw_input('OID bind principal DN: ')
ldapCredential = getpass('OID bind password: ')
userBaseDN = raw_input('OID user base DN: ')
groupBaseDN = raw_input('OID group base DN: ')

connect(adminUser, adminPassword, adminURL)
serverConfig()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
if realm.lookupAuthenticationProvider(providerName) is not None:
    raise ValueError('The provider name already exists')
if realm.lookupAuthenticationProvider('DefaultAuthenticator') is None:
    raise ValueError('This example requires DefaultAuthenticator')

edit()
startEdit()
cd('/')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
providerType = (
    'weblogic.security.providers.authentication.'
    'OracleInternetDirectoryAuthenticator'
)
provider = realm.createAuthenticationProvider(providerName, providerType)
provider.setControlFlag('SUFFICIENT')
provider.setHost(ldapHost)
provider.setPort(ldapPort)
provider.setPrincipal(ldapPrincipal)
provider.setCredential(ldapCredential)
provider.setGroupBaseDN(groupBaseDN)
provider.setUserBaseDN(userBaseDN)
defaultProvider = realm.lookupAuthenticationProvider('DefaultAuthenticator')
defaultProvider.setControlFlag('SUFFICIENT')

orderedProviders = [provider]
for existingProvider in realm.getAuthenticationProviders():
    if existingProvider.getName() != providerName:
        orderedProviders.append(existingProvider)
realm.setAuthenticationProviders(
    jarray.array(orderedProviders, AuthenticationProviderMBean)
)
save()
activate()

Table 5-3 lists the class types to specify for each type of Authentication Provider

Table 5-3 Class Types for External LDAP Authentication Providers

Provider	Class Type
Oracle Internet Directory	weblogic.security.providers.authentication.OracleInternetDirectoryAuthenticator
Oracle Virtual Directory	weblogic.security.providers.authentication.OracleVirtualDirectoryAuthenticator
Microsoft AD	weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
OpenLDAP	weblogic.security.providers.authentication.OpenLDAPAuthenticator
eDirectory	weblogic.security.providers.authentication.NovellAuthenticator
SunOne LDAP	weblogic.security.providers.authentication.IPlanetAuthenticator

Deploying Applications

The process for deploying applications varies depending on whether you use WLST offline or WLST online.

The following topics describe the process:

Using WLST Online to Deploy Applications

When WLST is connected to a domain's Administration Server, use the deploy command to deploy applications. (See deploy in WLST Command Reference for Oracle WebLogic Server.)

The command in Example 5-16 deploys a sample application from the WebLogic Server ExamplesServer domain.

Example 5-16 Deploying Applications

Replace appPath with the application path for your installation.

# Deploying Applications
appPath = (
    'C:/Oracle/Middleware/wlserver/samples/server/'
    'examples/build/examplesWebApp'
)
deploy('examplesWebApp', appPath)

Note:

Please note the following when using WLST online to deploy applications:

Deployment operations must be performed through the Administration Server. Your WLST client must connect to the Administration Server to invoke deployment commands.
You do not need to be in an edit session to deploy applications.

For more information about using WLST for deploying applications, see Deployment Tools in Deploying Applications to Oracle WebLogic Server.

Using WLST Offline to Deploy Applications

Table 5-4 describes the steps for using WLST offline to deploy applications in an existing domain.

Table 5-4 Steps for Deploying Applications (Offline)

To...	Use this command...	See ...
Use the Template Builder to create an application template.	not applicable	Creating an Extension Template Using the Domain Template Builder in Creating Domain Templates Using the Domain Template Builder
Open an existing WebLogic domain	`readDomain(domainDirName)`	readDomain in WLST Command Reference for Oracle WebLogic Server.
Add an extension template to the WebLogic domain	`selectTemplate(templateName)` `loadTemplates()`	selectTemplate and loadTemplates in WLST Command Reference for Oracle WebLogic Server
Save the WebLogic domain	`updateDomain()`	updateDomain in WLST Command Reference for Oracle WebLogic Server
Close the WebLogic domain	`closeDomain()`	closeDomain in WLST Command Reference for Oracle WebLogic Server

For an example of using the addTemplate command, see the following sample WLST script, where WL_HOME refers to the top-level installation directory for WebLogic Server:

WL_HOME\common\templates\scripts\wlst\clusterMedRecDomain.py