Introduction

This Security Guide is designed to help you understand how the WebLogic Portal product suite leverages the security features of the Java^TM 2 Platform Enterprise Edition (J2EE) specification and the J2EE-compliant security features of the WebLogic Server platform. It provides information about additional security measures that may have been established for individual application components within the WebLogic Portal product suite, and describes ways that you can modify security settings.

As an introduction to WebLogic Portal security, this topic includes the following sections:

Determining Your Application Security Needs

Security is a critical component of developing e-commerce applications that no organization can afford to ignore. Malicious individuals who gain access to your computer systems can temporarily interrupt business, but those who gain access to your customers' personal data can cause long-term damage to your reputation. Even if you have not had any security mishaps, customers are often hesitant to provide personal information over the Web, which could affect your ability to tailor products and services to customer preferences. Therefore, your organization must develop e-commerce applications that protect customer data and communicate a sense of privacy and purpose through the interface. At the same time, however, the application must not be difficult to navigate or perform slowly because of technical security requirements.

As the previous paragraph suggests, determining your application security needs can be challenging. You must balance the need for securing data with the need to make your site easy to navigate and perform quickly. You may want to ask yourself the following questions when attempting to define your application security requirements:

As you read the rest of this Security Guide, keep your answers to these questions in mind. By thinking upfront about your security requirements, you will be more likely to design security-aware applications, and may be better prepared to execute deployment activities.

Reliance on J2EE Standards and WebLogic Server Security

WebLogic Portal security implementations are based on the security requirements defined in the Java 2 Enterprise Edition (J2EE) specification, as well as the security measures implemented the BEA WebLogic Server^TM product.

This dependency has two important implications. First, if implemented properly, you can be confident that the applications you build using WebLogic Portal conform to the latest in J2EE security standards. Second, like the WebLogic Portal applications, your applications will also leverage the centralized security mechanisms of the WebLogic Server container, instead of requiring you to embed security code within individual Enterprise JavaBean (EJB) routines or their clients. Reliance on this centralized security model may significantly reduce the amount of effort required to build and maintain secure applications.

Declarative Security in WebLogic Portal

Because WebLogic Portal relies upon J2EE security requirements and the WebLogic Server's implementation of these requirements, security in the WebLogic Portal applications is primarily declarative.

A declarative approach to security has several advantages. First, declarative security is fine-grained, meaning that access can be restricted down to a specific method on a JavaBean. This gives you the flexibility to restrict only those resources that need protection. Second, an Application Assembler/Deployer can map security roles used within an application to the users and groups that already exist for a particular production environment at deployment time. This eliminates the need for individual developers to concern themselves with the security details of particular environments, and allows them to focus on other, possibly more important aspects of application development. Third, because deployment descriptor information is centralized and external to its associated application, it can be changed without modifying any JavaServer Page (JSP) or Enterprise JavaBean (EJB) source code. This architecture may significantly reduce the time developers spend debugging and maintaining code, as well as the likelihood of security holes due to programming errors.

Programmatic Security in WebLogic Portal

Security Behavior in a J2EE Environment

The following points provide a high-level overview of how security typically works in a J2EE environment. This information is included to provide some context for the WebLogic Server's security activities, as well as to provide a basic understanding of how an application's deployment descriptors and security roles fit into a security policy.

As you can see by this simplified description, the Web server acts as an authentication proxy by gathering authentication data from a client and using it to establish an authenticated connection to a protected resource.

About Security Realms

The default security realm for the WebLogic Portal is the RDBMS realm. That is, by default the server stores user IDs and passwords, group definitions, and ACLs in the RDBMS data repository.

WebLogic Portal also provides the following alternate security realms:

Next Steps

This Security Guide is intended mainly for individuals in your organization who act as Application Assemblers/Deployers and System Administrators, and assumes a certain level of familiarity with standard J2EE security implementations and with the security mechanisms of the BEA WebLogic Server.

If you have no prior or recent experience with J2EE or WebLogic Server, you may want to spend some time learning about these technologies before proceeding. The following documents contain additional information about WebLogic Portal and WebLogic Server product security, or provide supplemental information that may be helpful for understanding the contents of this Security Guide.

If you feel comfortable with J2EE and WebLogic Server security topics, proceed through this guide—either sequentially or nonsequentially—to answer your questions about WebLogic Portal security.