Sample Digest Authentication Configuration Using Embedded LDAP

You can use Converged Application Server's embedded LDAP implementation for Digest authentication in a test or demo environment. Because you cannot change the schema of the embedded LDAP store, you must store password information in the existing "description" field.

To use the embedded LDAP store for Digest authentication, follow the instructions in the sections that follow.

Store User Password Information in the Description Field

To create new users with password information in the existing description field:

  1. From the Security Data Tree of the Remote Console, click Realms, and then your specific realm, and then Authentication Providers, and then DefaultAuthenticator, and then Users.
  2. Click New.
  3. Enter a name for the new user in the Name field.
  4. Enter the Digest password information for the user in the Description field. The password information can be either the clear-text password, a pre-calculated hash value, or a reverse-encrypted password.
  5. Enter a minimum 8-character password in the Password field. You cannot proceed without adding a standard password entry.
  6. Click Create.

Set the Embedded LDAP Password

Follow these instructions to set the password for the embedded LDAP store to a known password.

  1. From the Edit Tree of the Remote Console, click Environment, and then Domain.
  2. Select the Security tab in the right pane, then select the Embedded LDAP subtab.
  3. Enter the password you would like to use in the Credential field.
  4. Click Save, then click the shopping cart, and then click Commit Changes.

Configure the Digest Identity Asserter Provider

Example 3-1 shows the security provider configuration in config.xml for a domain that uses LDAP implementation embedded in Converged Application Server. Note that such a configuration is recommended only for testing or development purposes. Example 3-1 highlights values that you must define when configuring the provider.

Example 3-1 Sample Security Provider Configuration with Embedded LDAP

<sec:authentication-provider xmlns:ext="http://www.bea.com/ns/weblogic/90/security/extension" xsi:type="ext:ldap-digest-identity-asserterType">
        <sec:name>myrealmLdapDigestIdentityAsserter</sec:name>
        <ext:user-base-dn>ou=people, ou=myrealm, dc=mydomain</ext:user-base-dn>
        <ext:credential-attribute-name>description</ext:credential-attribute-name>
        <ext:digest-realm-name>wlss.oracle.com</ext:digest-realm-name>
        <ext:host>server.example.com</ext:host>
        <ext:port>7001</ext:port>
        <ext:principal>cn=Admin</ext:principal>
      </sec:authentication-provider>