Environment Variable Tip when using OHS 12.1.2 by Simon Haslam

Environment Variable Tip when using OHS 12.1.2 by Simon Haslam

WebLogic Community

OHS in co-located WebLogic configurationHere’s a silly little issue I hit this afternoon – mostly a case of “administrator error” but a time waster nevertheless.
To recap, there was a big change to Web Tier administration in 12.1.2 in that OHS is controlled with what’s now called the “WebLogic Management Framework” – in short this means OHS instance configuration is handled via WLST and lifecycle (start/stop etc) by Node Manager (i.e. OPMN has gone). You have a choice of either co-locating OHS in your existing WebLogic domain (diagrams from the Oracle Documentation):
Otherwise you can have OHS on its own: Read the complete article here.

WebLogic Partner Community

For regular information become a member in the WebLogic Partner Community please visit: http://www.oracle.com/partners/goto/wls-emea ( OPN account required). If you need support with your account please contact the Oracle Partner Business Center.

BlogTwitterLinkedInMixForumWiki

Technorati Tags: OHS,Simon…

View original post 13 more words

ACM training material

ACM training material

SOA Community Blog

At our SOA Community Workspace (SOA Community membership required) you can download the Adaptive Case Management training material from the Malta Community Forum: ACM bootcamp 02.2014. The material does not include the software image.

SOA & BPM Partner Community

For regular information on Oracle SOA Suite become a member in the SOA & BPM Partner Community for registration please visit www.oracle.com/goto/emea/soa (OPN account required) If you need support with your account please contact the Oracle Partner Business Center.

BlogTwitterLinkedInimage[7][2][2][2]Facebookclip_image002[8][4][2][2][2]Wiki

View original post

Advanced WebLogic Server Automation: Administration and Monitoring with WLST and JMX – New Book by Martin Heinzl

Advanced WebLogic Server Automation: Administration and Monitoring with WLST and JMX – New Book by Martin Heinzl

WebLogic Community

All production environments need automated, auditable, and reproducible processes. This book discusses how to automate all aspects of WebLogic, an essential prerequisite for all production environments. The WebLogic Server platform is recognized as one of the leading J2EE application servers and is the foundation of the Fusion Middleware platform. It is well suited for a variety of different application architectures including modern grid and cloud infrastructures. A large number of WebLogic installations from a single server to thousands of servers exist all over the world. Complex environments may consist of hundreds of domains and thousands of managed-servers. It is impossible for an administrator group to maintain all those servers with manual tasks or the web console. This book is written based on 15+ years of experience with many real architecture and consultancy assignments, and includes tips based on lessons learned from real project experience. Its main focus is to teach…

View original post 140 more words

IT-Security: Part 1 to 5 as PDF file

Key words:IT-Security, Security Challenges, OPSS Architecture, WebLogic Server, JAAS, JAAS LoginModules, Authentication, Basic Authentication, Certificate Authentication, Digest Authentication, perimeter Authentication and Identity Assertion

Until now I have published five parts of a series of articles on IT-Security and Oracle Fusion Middleware:

  1. http://thecattlecrew.wordpress.com/2014/02/17/it-security-weblogic-server_1/
  2. http://thecattlecrew.wordpress.com/2014/03/05/it-security-part-2-weblogic-server-and-oracle-platform-security-services-opss-2/
  3. http://thecattlecrew.wordpress.com/2014/03/14/it-security-part-3-weblogic-server-and-java-security-features/
  4. http://thecattlecrew.wordpress.com/2014/06/05/it-security-weblogic-server-and-authentication-part-4/
  5. http://thecattlecrew.wordpress.com/2014/06/22/it-security-part-5-weblogic-server-perimeter-authentication-and-identity-assertion/

I’m going to continue the IT-Security’s articles and you can access to complete first five parts as PDF-file here:

WebLogic-Server_IT_Security_1til5

IT-Security (Part 5): WebLogic Server, perimeter Authentication and Identity Assertion

I tried to discuss about “perimeter authentication” in one extra part of IT-Security’s blogs, because this authentication’s process is an essential approach in a heterogonous world of systems, applications and technologies that they need to trust and communicate to each other.  Generally, we discussed about perimeter authentication, if a remote user requires an asserted identity and some form of proof material to an authentication server that performs the verification and then passes an artifact, or token, to the application server domain.[1]

If we want to identify a remote user outside of the WebLogic server domain, as an authentication server, then we need to another approach for authenticating’s process instead basic authentication with username and password[2]. This authentication’s process is called perimeter authentication. It establishes trust via a passphrase, e.g. tokens. Tokens will be generated as part of the authentication process of users or system processes and could have many different types and / or vendors, e.g. Kerberos and Security Assertion Markup Language (SAML). WebLogic Server is able to use the token(s) so that users are not requested to sign on more than once.

This form of authentication operates with authentication agent. It performs an authentication process that outcomes in a token. It contains the authentication information of user and guarantees for the user’s identity. The Figure1 Perimeter Authentication[3] presents the sequence of events in authenticating process:

Remote User sends a request with passphrase to Authentication Agent. It creates a token and sends to WebLogic Server to access resources and / or application(s). The WebLogic Server perform perimeter authentication via Identity Assertion.

p5_PerimeterAuthentication_1

Perimeter Authentication

Figure 1 Perimeter Authentication

We can define the Identity Assertion provider, as a specific form of Authentication provider that permits users or applications to assert their identity using tokens. With other words, it supports user’s mappers, which map a valid token to a WLS-User. It is possible to develop your own or use a third-party security vendor’s Identity Assertion providers. Identity assertion can use perimeter authentication schemes such as the Security Assertion Markup Language (SAML), the Simple and Protected GSS-API Negotiation Mechanism (SPNEGO), or enhancements to protocols such as Common Secure Interoperability (CSI) v2 and support single sign-on.[4]  The WebLogic Identity Assertion providers support the following token types[5] (here is a selected list of token types):

  • AU_TYPE, for a WebLogicAuthenticatedUserused as a token.
  • X509 is an ITU-T standard for a public key infrastructure (PKI) and Privilege Management Infrastructure (PMI) and RFC 4158 provides information and guidance for certification path building.[6]
  • X509_TYPE, for an X509 client certificate used as a token:
  • CSI_X509_CERTCHAIN_TYPE, for a CSIv2 X509 certificate chain identity used as a token.

“The Negotiate Identity Assertion provider is used for SSO with Microsoft clients that support the SPNEGO protocol. The Negotiate Identity Assertion provider decodes SPNEGO tokens to obtain Kerberos tokens, validates the Kerberos tokens, and maps Kerberos tokens to WebLogic users. The Negotiate Identity Assertion provider utilizes the Java Generic Security Service (GSS) Application Programming Interface (API) to accept the GSS security context via Kerberos. The Negotiate Identity Assertion provider is for Windows NT Integrated Login.” [7]

  • AUTHORIZATION_NEGOTIATE, for a SPNEGO internal token used as a token.
  • WWW_AUTHENTICATE_NEGOTIATE, for a SPNEGO internal token used as a token.

“The SAML Identity Assertion providers handle SAML assertion tokens when WebLogic Server acts as a SAML destination site. The SAML Identity Assertion providers consume and validate SAML assertion tokens and determines if the assertion is to be trusted (using either the proof material available in the SOAP message, the client certificate, or some other configuration indicator).”[8]   I am going back to SAML topic in an additional article(s).

  • SAML_ASSERTION_B64_TYPE, for a Base64 encoded SAML.assertion used as a token.
  • SAML_ASSERTION_DOM_TYPE, for a SAML DOM element used as a token.
  • SAML_ASSERTION_TYPE, for a SAML string XML form used as a token.
  • SAML2_ASSERTION_DOM_TYPE, for a SAML2 DOM element used as a token.
  • SAML2_ASSERTION_TYPE, for a SAML2 string XML form used as a token.
  • SAML_SSO_CREDENTIAL_TYPE, for a SAML string consisting of the TARGET parameter concatenated with the assertion itself and used as a token.

I introduced about Digest Authentication[9] in previous blog and WebLogic supports für Web Service application the following Digest type:

  • WSSE_PASSWORD_DIGEST_TYPE, for a username token with a password type of password digest used as a token.

The Authentication and Identity Assertion Process

Now, we can compare Basic authentication Process with Identity Assertion Process. On Figure 2 Authentication Process (Principal Validation Process)[10] shows the authentication process for a fat-client login. A user attempts to log into a system using a username/password combination. WebLogic Server establishes trust by calling the configured Authentication provider’s LoginModule, which validates the user’s username and password and returns a subject that is populated with principals per Java Authentication and Authorization Service (JAAS) [11] requirements. In this way, an authentication context will be established and user can access to certain resource and / or components in WebLogic Domain.

Authentication Process (Principal Validation Process)

Authentication Process (Principal Validation Process)

 

Figure 2 Authentication Process (Principal Validation Process)

Figure 3 Perimeter Authentication presents the perimeter authentication process[12].

  1. A token from outside of WebLogic Server is passed to an Identity Assertion provider that is responsible for validating tokens of that type and that is configured as “active”.
  2. If the token is successfully validated, the Identity Assertion provider maps the token to a WebLogic Server username, and sends that username back to WebLogic Server, which then continues the authentication process as described above. It requires the same components, but also adds an Identity Assertion provider. Specifically, the username is sent via a Java Authentication and Authorization Service (JAAS)CallbackHandlerand passed to each configured Authentication provider’s LoginModule, so that the LoginModule can populate the subject with the appropriate principals.
Perimeter Authentication

Perimeter Authentication

 

Figure 3 Perimeter Authentication

If you compare the two ways of authentication, then you can find out a core security characteristic of WebLogic Server too. It is mean; WebLogic Server security architecture has a consistence modular structure and therefore can response rapid to new challenges and technologies in security area. This architecture is capable to expand its features und integrate new security components in itself.

[1] Oracle® Fusion Middleware: Understanding Security for Oracle WebLogic Server, 11g Release 1 (10.3.6), E13710-06

[2] For „Basic Authentication: Username/Password“ see: http://thecattlecrew.wordpress.com/2014/06/05/it-security-weblogic-server-and-authentication-part-4/

[3] Oracle® Fusion Middleware: Understanding Security for Oracle WebLogic Server, 11g Release 1 (10.3.6), E13710-06

[4] Oracle® Fusion Middleware Developing Security Providers for Oracle WebLogic Server, 11g Release 1 (10.3.6), Part Number E13718-05, http://docs.oracle.com/cd/E23943_01/web.1111/e13718/ia.htm

[5] Oracle® Fusion Middleware Developing Security Providers for Oracle WebLogic Server, 11g Release 1 (10.3.6), Part Number E13718-05, http://docs.oracle.com/cd/E23943_01/web.1111/e13718/ia.htm

[6] See: http://tools.ietf.org/html/rfc4158

[7] Oracle® Fusion Middleware Developing Security Providers for Oracle WebLogic Server, 11g Release 1 (10.3.6), Part Number E13718-05, http://docs.oracle.com/cd/E23943_01/web.1111/e13718/ia.htm

[8] Oracle® Fusion Middleware Developing Security Providers for Oracle WebLogic Server, 11g Release 1 (10.3.6), Part Number E13718-05, http://docs.oracle.com/cd/E23943_01/web.1111/e13718/ia.htm

[9] See http://thecattlecrew.wordpress.com/2014/06/05/it-security-weblogic-server-and-authentication-part-4/

[10] See: http://docs.oracle.com/cd/E23943_01/web.1111/e13718/atn.htm#i1141106

[11] IT-Security (Part 3): WebLogic Server and Java Security Features: http://thecattlecrew.wordpress.com/2014/03/14/it-security-part-3-weblogic-server-and-java-security-features/

[12] See http://docs.oracle.com/cd/E23943_01/web.1111/e13718/ia.htm

How to fix the ADF Security error “JpsAnonymousRoleImpl” in Jdev 11.1.1.6.0

How to fix the ADF Security error “JpsAnonymousRoleImpl” in Jdev 11.1.1.6.0

Udaya's Blog

I have created a sample ADF application in Jdev 11.1.1.6.0 and when executed in “Integrated Weblogic server” within Jdev, it did not display any error message in the console and the application web page is loaded in the default browser successfully.

Now I added the ADF Security for the Application. To do this, From the Menu options select the Application –> select Secure->Configure ADF Security

ADF Authentication and Authorization –> Form Based Authentication (Generate the default login and error pages. Should be something like “/login.html“) -> No Automatic Grants -> Finish.

Now when I executed my Application in Jdev, I was getting the “<CodebasePolicyHandler> <migrateDeploymentPolicies> Migration of codebase policy failed. Reason: {0}. oracle.security.jps.JpsException: java.lang.IllegalArgumentException: oracle.security.jps.internal.core.principals.JpsAnonymousRoleImpl”   error before my web page opens up in the browser.

Even after you delete the ADF security this error still occurs.

So Now lets see how to fix…

View original post 302 more words

How to redirect Webcenter Content Server or UCM to Remote Database

How to redirect Webcenter Content Server or UCM to Remote Database

Udaya's Blog

Inorder to redirect the Webcenter Content Server or UCM to Remote Database, both Remote Database & RCU should be compatible versions and remote DB machine should be reachable from Content Server (CS) machine.

Pointing can be changed from Weblogic Server (WLS) console:

1) Please take backup of config.xml & cs-ds-jdbc.xml

  •  OracleMiddlewareuser_projectsdomainsbase_domainconfig
  •  OracleMiddlewareuser_projectsdomainsbase_domainconfigjdbc

2) Login to WLS console as admin user (weblogic) and browse through (  Home >Summary of JDBC Data Sources >CSDS >Summary of JDBC Data Sources >CSDS )

3) Click on Connection Pool tab

4) Change hostname, service id, port, user & passwords.

5) Just restart the managed servers first & monitor logs for errors if any.

6) Shutdown managed & admin server & start.

Now the WebCenter Content server or UCM will use the schema available in the remote database.

View original post