Before you configure authentication for Web Services Manager, create a user, group, and security realm for Web Services Manager in WebLogic Server. For more information about creating users and groups, see the discussion about users, groups, and security roles in Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server. For more information about security realms, see the discussion about security realms in WebLogic Server in Fusion Middleware Securing Oracle WebLogic Server.

To configure authentication for Web Services Manager in WebLogic Server:

1. Open the local_dir/infranetwebsvc.war/WEB-INF/weblogic.xml file in a text editor, where local_dir is a directory on the WebLogic host where you copied the infranetwebsvc.war file.

2. Remove the comment from the following lines:

   # <security-role-assignment>
      # <role-name>brmws</role-name>
      # <externally-defined/>
   # </security-role-assignment>

3. Save and close the file.

4. Open the local_dir/infranetwebsvc.war/WEB-INF/web.xml file in a text editor.

5. Remove the comment from the following lines:

   # <security-constraint>
     # <web-resource-collection>
      #  <web-resource-name>restricted web services</web-resource-name>
       # <url-pattern>/*</url-pattern>
       # <http-method>GET</http-method>
       # <http-method>POST</http-method>
     # </web-resource-collection>
    # <auth-constraint>
       # <role-name>brmws</role-name>
     # </auth-constraint>
     # <user-data-constraint>
      # <transport-guarantee>CONFIDENTIAL</transport-guarantee>
     # </user-data-constraint>
   # </security-constraint>
   
   # <login-config>
    # <auth-method>BASIC</auth-method>
    # <realm-name>default</realm-name>
   # </login-config>
   # <security-role>
       # <role-name>brmws</role-name>
   # </security-role>

6. Save and close the file.

7. Log in to WebLogic Server Remote Console.

8. Click Edit Tree, then Environment, then Servers.

   A table containing the list of servers in the domain is displayed.

9. Select the server for which you want to enable the SSL port.

10. In the General subtab, select SSL Listen Port Enabled.

11. In the SSL Listen Port field, enter a free port number. The default is 7002. Make a note of the values in the Listen Port and SSL Listen Port fields.

12. Click Save.

    If you use a SOAP development application to generate a web service client and use port numbers other than the default port numbers, the URLs for the web services that take the payload as an XML element show port numbers that do not match the port numbers you configured in WebLogic Server Remote Console. Populate the correct port numbers in the URLs for the WSDL files that are generated dynamically by your SOAP development application by changing the port numbers manually in your SOAP development application request.

You define access restrictions for web services in security policies in WebLogic Server.

To configure WebLogic Security Policy on BRM Web Services for JAX-WS in WebLogic Server:

1. Determine the port binding name for each of the endpoints that you intend to secure. For each endpoint, do the following:

   1. Look at the WSDL file for the endpoint. See "Determining the WSDL URLs for Web Services Manager" for information about accessing the WSDL.

   2. In the WSDL file, find the port name. It may be near the end of the file. For example, the following line contains the port name for the BRMReadServices_v2:

      <port binding="brm:BRMReadService_binding" name="BRMReadService_pt">

      For this endpoint, the name is BRMReadService_pt.

   3. Record the port name.

2. Determine which of the policies supplied with WebLogic Server you would like to implement. For example:

   • If you want to use the policy for HTTPS with basic authentication, you could use Wssp1.2-2007-Https-BasicAuth.xml.

   • If you want to use the policy for HTTPS without authentication, you could use Wssp1.2-2007-Https.xml.

3. Create the BRM_home/apps/deploy/web_services/brm_wsm_ws_policy and BRM_home/apps/deploy/web_services/brm_wsm_ws_policy/WEB-INF directories.

4. In the BRM_home/apps/deploy/web_services/brm_wsm_ws_policy/WEB-INF directory, create a weblogic-webservices-policy.xml file in the following format:

   <webservice-policy-ref xmlns=http://xmlns.oracle.com/weblogic/webservice-policy-ref
       xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance
       xsi:schemaLocation=http://xmlns.oracle.com/weblogic/webservice-policy-ref
                          http://xmlns.oracle.com/weblogic/webservice-policy-ref/1.1/webservice-policy-ref.xsd> 
     <port-policy>
         <port-name>portName1</port-name>
         <ws-policy>     
             <uri>policy:policyFilename</uri>      
             <direction>both</direction>      
             <status>enabled</status>   
         </ws-policy>  
     </port-policy> 
     <port-policy>    
         <port-name>portName2</port-name>    
         <ws-policy>     
             <uri>policy:policyFilename</uri>      
             <direction>both</direction>      
             <status>enabled</status>   
         </ws-policy>  
     </port-policy>
   . . .
     <port-policy>    
         <port-name>portNamen</port-name>    
         <ws-policy>     
             <uri>policy:policyFilename</uri>      
             <direction>both</direction>      
             <status>enabled</status>   
         </ws-policy>  
     </port-policy></webservice-policy-ref>

   where:

   • portName1 is the port name for the first endpoint, for example BRMReadService_pt.

   • portName2 is the port name for the second endpoint, for example BRMCustService_pt.

   • portNamen is the port name for the nth endpoint, for example BRMSubscriptionService_pt.

   • policyFilename is the name of the WebLogic Server policy file you are using, for example Wssp1.2-2007-Https-BasicAuth.xml.

5. If you are using the services in the infranetwebsvc.war file, do the following:

   1. Create the following plan.xml file and put it in the appropriate deployment directory:

      <deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
        <application-name>deploymentName</application-name>
        <module-override>
          <module-name>infranetwebsvc.war</module-name>
          <module-type>war</module-type> 
          <module-descriptor external="true">
            <root-element>webservice-policy-ref</root-element>
            <uri>WEB-INF/weblogic-webservices-policy.xml</uri>
          </module-descriptor>
        </module-override>
        <config-root>policyPath</config-root>
      </deployment-plan>
      

      where:

      • deploymentName is the name of the deployment in WebLogic that contains infranetwebsvc.war.

      • policyPath is the path to the brm_wsm_ws_policy directory you created above, that is, BRM_home/apps/deploy/web_services/brm_wsm_ws_policy.

   2. Redeploy the deployment in WebLogic that contains infranetwebsvc.war.

6. If you are using the services in the BrmWebServices.war file:

   1. Create the following plan.xml file and put it in the appropriate deployment directory:

      <deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
        <application-name>deploymentName</application-name>
        <module-override>
          <module-name>BrmWebServices.war</module-name>
          <module-type>war</module-type> 
          <module-descriptor external="true">
            <root-element>webservice-policy-ref</root-element>
            <uri>WEB-INF/weblogic-webservices-policy.xml</uri>
          </module-descriptor>
        </module-override>
        <config-root>policyPath</config-root>
      </deployment-plan>
      

      where:

      • deploymentName is the name of the deployment in WebLogic that contains BrmWebServices.war.

      • policyPath is the path to the brm_wsm_ws_policy directory you created above, that is, BRM_home/apps/deploy/web_services/brm_wsm_ws_policy.

   2. Redeploy the deployment in WebLogic that contains BrmWebServices.war.

7. To verify that the security policy has been added, access the WSDL for the endpoint again, and look for text similar to the following:

   <wsp:UsingPolicy wssutil:Required="true"/>
   <ns0:Policy xmlns:ns0="http://schemas.xmlsoap.org/ws/2004/09/policy" wssutil:Id="DefaultReliability.xml">
   <ns1:RMAssertion xmlns:ns1="http://schemas.xmlsoap.org/ws/2005/02/rm/policy">
   <ns1:InactivityTimeout Milliseconds="600000"/>
   <ns1:BaseRetransmissionInterval Milliseconds="3000"/>
   <ns1:ExponentialBackoff/>
   <ns1:AcknowledgementInterval Milliseconds="200"/>
   <ns2:Expires xmlns:ns2="http://www.bea.com/wsrm/policy" Expires="P1D"/>
   </ns1:RMAssertion>
   </ns0:Policy>

If you have enabled SSL, add the following entry in the session-config element of the BrmWebServices.war/WEB-INF/web.xml file to enable cookie security:

<cookie-config>
    <secure>true</secure>
</cookie-config>

Specifying the JUL mechanism allows Web Services Manager to use JUL in addition to the WebLogic Server Remote Console logging.

To specify the JUL mechanism:

1. Open the BRM_home/deploy/web_services/Infranet.properties file in a text editor.

2. Uncomment the following entry:

   # webservices.log.enabled = true
   

3. Change the value to false:

   webservices.log.enabled = false
   

4. Save and close the file.

You define a startup class to enable JUL and create log files for the following web service classes:

• com.portal.webservices.BRMFlistToXML

• com.portal.webservices.BRMXMLToFlist

• com.portal.webservices.OpcodeCaller

• com.portal.webservices.WebServicesUtilities

To create a startup class:

1. Copy the BRM_home/deploy/web_services/weblogic_ws_startup.jar file to the domain_name/lib directory, where domain_name is the WebLogic Server domain in which Web Services Manager is deployed.

2. Log in to WebLogic Server Remote Console.

3. Click Edit Tree, then Environment, then Startup Classes.

   A list of any startup classes is displayed in a table.

4. Click New.

5. In the Name field, enter BRMWSLoggerStartUpClass and click Create.

6. In the Class Name field, enter com.portal.webservices.BRMWSLoggerStartUp.

7. In the Arguments field, set the log level. This field sets the log level for all the classes in Web Services Manager:

   • To log problems that require attention from the system administrator, enter SEVERE. This is the default.

   • To log the most detailed trace and debug messages, enter FINEST.

   • To log highly detailed trace and debug messages, enter FINER.

   • To log trace and debug messages for performance monitoring, enter FINE.

8. Turn on Run Before Application Deployments and Run Before Application Activations.

9. Click the Targets tab, move your administration server name in the Targets list to the Chosen area, and click Save.

10. Restart the WebLogic Server, which applies changes.

11. Redeploy any existing Web Services Manager deployments. See "Deploying and Running Web Services Manager".

By default, log files are created in the WebLogic_home/user_projects/domains/domain_name/logs/BRMWebServicesMgrLogs/BRMWebServicesMgr.log file.

where:

• WebLogic_home is the directory in which WebLogic Server is installed.

• domain_name is the name of the domain you are configuring.