Adding Security to a Portal

A Web server authenticates users and determines which resources within the server users can create, access, or modify. To do this, the Web server uses a security realm. When a user attempts to access a particular resource, the server tries to authenticate and authorize that user by checking the access control list (ACL) and permissions that are assigned to the user within the realm. You can set up multiple security realms, but each instance of a Web server can use only one realm. The server uses the same security realm for your Web site developers and for your visitors.

This section contains information on the following subjects:

Implementing Portal Security

If you choose to use the basic implementation of the RDBMS security realm supplied by BEA, it will be available when you install WebLogic Portal. No further configuration is necessary.

Note: The WebLogic Portal RDBMS Realm is a different implementation than the WebLogic Server RDBMS Realm. The WebLogic Server RDBMS Realm is for testing and is not suitable for use in a production environment. WebLogic Portal's RDBMS realm is shipped in the BEA_HOME/weblogic700/portal/lib/p13n_system.jar file and the implementing class is in com.bea.p13n.security.realm.RDBMSRealmas configured with the config.xml file entry: RealmClassName="com.bea.p13n.security.realm.RDBMSRealm.

Integrating with an LDAP Security Realm

If you don't want to use the basic RDBMS security realm, one popular alternative is to use a lightweight directory access protocol (LDAP) server as your security realm. This section describes how to integrate an LDAP server with WebLogic Portal. Procedures in this section describe the following LDAP integration scenarios:

Supported LDAP Servers

WebLogic Portal supports these LDAP servers:

Integrating an LDAP Security Realm

This section shows how WebLogic Portal integrates with a third-party LDAP security realm; security realms are the method used by WebLogic Portal to authenticate users. While WebLogic Portal provides a default user store based on a RDBMS, this can be replaced with an LDAP realm, which uses an LDAP server for security information.

Configuring the LDAP Server for Integration

Configuring the LDAP security realm involves defining attributes that enable the LDAP Security realm in WebLogic Server to communicate with the LDAP server and the attributes that describe how users and groups are stored in the LDAP directory. The LDAP tree and schema is different for every LDAP server.

Supported Server Templates

Warning: Each line in the following code examples must appear on a single line. The examples shown below have been formatted to fit the margins of this document and some lines have been broken to facilitate that formatting. If you paste this text into the config.xml file, be sure to concatenate the lines that are broken so that they appear on a single line in your code.

Listing 7-1 Default Netscape Customer Security Realm Template

<CustomRealm
   Name="defaultLDAPRealmForNetscapeDirectoryServer"
   RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
   Password="*secret*"
   ConfigurationData="server.host=ldapserver.example.com;server.principal=uid=
      admin,
   ou=Administrators, ou=TopologyManagement, o=NetscapeRoot;user.dn=ou=people,
   o=beasys.com;user.filter=(&amp;(uid=%u)(objectclass=person));group.dn=
      ou=groups,
   o=beasys.com;group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));
      membership.filter=(&amp;(uniquemember=%M)(objectclass=
      groupofuniquenames));"
   Notes="This is provided as an example. Before enabling this Realm, you must
   edit the configuration parameters as appropriate for your environment."
/>

Listing 7-2 Default Microsoft Customer Security Realm Template

<CustomRealm
   Name="defaultLDAPRealmForMicrosoftSiteServer"
   RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
   Password="*secret*"
   ConfigurationData="server.host=ldapserver.example.com;server.principal=cn=
      Administrator,
   ou=Members, o=ExampleMembershipDir;user.dn=ou=Members,
   o=ExampleMembershipDir;user.filter=(&amp;(cn=%u)(objectclass=member));
      group.dn=ou=Groups,
   o=ExampleMembershipDir;group.filter=(&amp;(cn=%g)(objectclass=mgroup));
      membership.scope.depth=1;microsoft.membership.scope=sub;membership.
      filter=(|(&amp;(memberobject=%M)(objectclass=memberof))
      (&amp;(groupobject=%M)(objectclass=groupmemberof)));"
   Notes="This is provided as an example. Before enabling this Realm, 
      you must edit the configuration parameters as appropriate for your 
      environment."
/>

Listing 7-3 Default Novell Customer Security Realm Template

<CustomRealm
   Name="defaultLDAPRealmForNovellDirectoryServices"
   RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
   Password="*secret*"
   ConfigurationData="server.host=ldapserver.example.com;server.principal=cn=
      admin,
   o=example.com;user.dn=ou=people,
   o=example.com;user.filter=(&amp;(cn=%u)(objectclass=person));group.dn=ou=
      groups,
   o=example.com;group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));
      membership.filter=(&amp;(member=%M)(objectclass=groupofuniquenames));"
   Notes="This is provided as an example. Before enabling this Realm, you must
      edit the configuration parameters as appropriate for your environment."
/>

Listing 7-4 Default OpenLDAP Security Realm Template

<CustomRealm
   Name="defaultLDAPRealmForOpenLDAPDirectoryServices"
   RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"
   Password="*secret*"
   ConfigurationData="server.host=ldapserver.example.com;server.principal=cn=
      Manager,
   dc=example, dc=com;user.dn=ou=people, dc=example,
   dc=com;user.filter=(&amp;(uid=%u)(objectclass=person));group.dn=ou=groups,
   dc=example,
   c=com;group.filter=(&amp;(cn=%g)(objectclass=groupofuniquenames));membership.
      filter=(&amp;(uniquemember=%M)(objectclass=groupofuniquenames));"
   Notes="This is provided as an example. Before enabling this Realm, you must
      edit the configuration parameters as appropriate for your environment."
/>

Integrating with LDAP Security and a User Profile

Prerequisites

In order to successfully retrieve the user profile from the LDAP server, ensure that you've done the following:

Configuring the Server for Integration

Configuring the WebLogic server to integrate with an LDAP security realm and profile requires two configuration processes.

Other Supported Security Realms

In addition to LDAP, WebLogic Server supports these security realms:

Enabling Secure Sockets Layer Security

The Webflow and Pipeline mechanisms that direct the presentation and business logic associated with WebLogic Portal's Commerce JSP templates make use of the Secure Sockets Layer (SSL) and declarative transport mechanisms. Links that invoke protected JSP files, as well as certain Input Processors and Pipelines, need to be accessed via the HTTPS protocol. There are a number of these links already defined in the Commerce (wlcs) Web application's web.xml deployment descriptor. Secured JSP templates that rely on SSL also require a setting in the web.xml file that indicates the transport guarantee. This guarantee can be CONFIDENTIAL or INTEGRAL.

Note: For SSL connections to work, you must have a valid SSL certificate from a certificate authority set up on your server.

config.xml Requirements for SSL

Listing 7-5 Enabling SSL in the config.xml File

<server>
.
.
.
   <SSL Enabled="true" ListenPort="7502" Name="portalServer"
      ServerCertificateChainFileName="ca.pem"
      ServerCertificateFileName="democert.pem"
   ServerKeyFileName="demokey.pem"/>

</server>

The SSL attribute should also identify the necessary certificate filenames, the server key filename, and the server name.

config.xml is stored in <BEA_HOME>/user_projects/<YOUR_DOMAIN>.

where <YOUR_DOMAIN> is the domain folder created when you ran the Configuration Wizard.

web.xml Requirements for SSL

Listing 7-6 Identifying Listen Ports

<context-param> 
  <param-name>HTTPS_PORT</param-name> 
  <param-value>7502</param-value> 
</context-param>

Enabling Single Sign-On

With single sign-on enabled, a visitor needs only to sign-on once to access multiple web applications, provided those applications are running on the same server or cluster. Enabling single sign-on requires these steps:

Setting the Cookie Name

Set the cookie name for each application to which the visitor will have single sign-on access. To do this, edit the weblogic.xml file located in <BEA_HOME>weblogic700\ samples\portal<PORTAL_DOMAIN>\beaApps\<PORTAL_APP>\<PORTAL>\WEB-INF\ for each application to which the visitor will have single sign-on access.

Listing 7-7

<session-param>
   <param-name>CookieName</param-name>
   <param-value>JSESSIONID_SAMPLEPORTAL</param-value>
</session-param>

Setting the User Properties