{"id":1505,"date":"2010-02-04T21:52:02","date_gmt":"2010-02-05T01:52:02","guid":{"rendered":"http:\/\/onlineappsdba.com\/index.php\/2010\/02\/04\/how-to-integrate-weblogic-with-oracle-internet-directory-for-login-authentication\/"},"modified":"2015-12-01T10:37:41","modified_gmt":"2015-12-01T14:37:41","slug":"how-to-integrate-weblogic-with-oracle-internet-directory-for-login-authentication","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2010\/02\/04\/how-to-integrate-weblogic-with-oracle-internet-directory-for-login-authentication\/","title":{"rendered":"How to integrate WebLogic with Oracle Internet Directory for Login : Authentication"},"content":{"rendered":"

This post is from our Oracle WebLogic training for Administrators\/DBA’s<\/a>\u00a0which covers step by step instructions on “How to integrate Oracle WebLogic Server with OID (Oracle Internet Directory) for user Login\/Authentication<\/strong>”<\/p>\n

By Default Oracle WebLogic Server uses security realm with name “myrealm<\/strong>” that uses\u00a0embedded LDAP server (two default\u00a0users WebLogic<\/strong> & OracleSystemUser<\/strong>) that acts as data store for Authentication, Authorization, Credential Mapping and Role Mapping Provider.<\/p>\n

You can\u00a0view Embedded LDAP Server configuration from WebLogic Console Page (\/console<\/strong>) : Domain <\/strong>-> Security<\/strong> -> Embedded LDAP Server<\/strong><\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

If you wish to login to WebLogic Server using users in Oracle Internet Directory (more on OID here<\/a>) or\u00a0allow access to your WebServices to users in OID (OWSM\u00a0Policy) then you\u00a0will have to define new Authentication\u00a0Providers in your WebLogic\u00a0realm (myrealm)<\/strong> . Authentication Provider supported by WebLogic are LDAP<\/strong>, RDBMS<\/strong>, Windows NT<\/strong>, SAML<\/strong>, Password Validator<\/strong>, Identity Assertion<\/strong>\u00a0 etc..<\/p>\n

Before I jump to step by step OID (LDAP) authentication provider configuration for WebLogic, lets first check few important things<\/p>\n

1.<\/strong>You can configure one or more (minimum one) Authentication Provider in a security realm in WebLogic.<\/p>\n

2.<\/strong> For multiple Authentication Providers, they are called in order in which they were configured in the\u00a0security realm.<\/p>\n

3.<\/strong> Control Flag<\/strong>: (as shown in 4th image from top) is used to control how authentication providers are used in login sequence. These are also called as JAAS control flag and values are : REQUIRED , REQUISITE, SUFFICIENT, OPTIONAL<\/p>\n

REQUIRED<\/strong> – The Authentication provider is always called, and the user must always pass its authentication test. Regardless of whether authentication succeeds or fails, authentication still continues down the list of providers<\/p>\n

REQUISITE<\/strong> –\u00a0The user is required to pass the authentication test of this Authentication provider. If the user passes the authentication test of this Authentication provider, subsequent providers are executed but can fail (except for Authentication providers with the JAAS Control Flag set to REQUIRED).<\/p>\n

SUFFICIENT<\/strong> – The user is not required to pass the authentication test of the Authentication provider. If authentication succeeds, no subsequent Authentication providers are executed. If authentication fails, authentication continues down the list of providers.<\/p>\n

OPTIONAL<\/strong> – The user is allowed to pass or fail the authentication test of this Authentication provider. However, if all Authentication providers configured in a security realm have the JAAS Control Flag set to OPTIONAL, the user must pass the authentication test of one of the configured providers.<\/p>\n

.<\/p>\n

Things required to configure OID as authentication Provider in WebLogic<\/u><\/strong><\/p>\n

1.<\/strong> OID Server Name
\n2.<\/strong> OID Port
\n3<\/strong>. Password for cn=orcladmin<\/strong> account ->\u00a0\u00a0WebLogic Server uses this account to connect to LDAP Server
\n4.<\/strong>BASE DN of your user base in OID -> cn=users, [default OID realm] (usually of format cn=users, dc=uk, dc=co, dc=focusthread<\/strong>)
\n5.<\/strong>BASE DN of your\u00a0group base in OID -> cn=groups, [default OID realm] (usually of format cn=groups, dc=uk, dc=co, dc=focusthread<\/strong>)<\/p>\n

For steps on how to find OID Port or OID realm<\/strong> click here<\/a><\/p>\n

.<\/p>\n

How to configure\u00a0OID\u00a0as\u00a0Authentication Provider in WebLogic <\/u><\/strong><\/p>\n

1. <\/strong>Login to WebLogic Console<\/strong> -> Security Realm<\/strong> -> myrealm<\/strong>
\n.<\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

2.<\/strong> Select tab Providers -> Authentication -> Default Provider <\/strong><\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

3.<\/strong> Change Control Flag (JAAS Flag) from REQUIRED to SUFFICIENT<\/strong><\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

4.<\/strong> Click on New<\/strong> to add new Authentication Provider<\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

5.<\/strong> Select OracleInternetDirectoryAuthenticator<\/strong>
\n\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

6.<\/strong> Change control flag to SUFFICIENT <\/strong>for OID Authentication Provider added above<\/p>\n

\"\"<\/a><\/p>\n

.<\/p>\n

7.<\/strong> Select Provider Specific tab and enter your OID server details<\/p>\n

Do not forget to change “User Base DN<\/strong>” and “Group Base DN<\/strong>” as per your OID<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

8. <\/strong>Bounce WebLogic Server<\/p>\n

To test if Integration is working :<\/strong>Create a group (Administrators or Deployers or Operators or Monitors) and\u00a0dummy user as member of group\u00a0in OID and try to login to WebLogic Server using user in OID who is member of one of group in OID.<\/p>\n

.<\/p>\n

How to Debug if Login to WebLogic\u00a0via OID user fails\u00a0?<\/u><\/strong><\/p>\n

You can enable debug on Login (Security) to find debug messages in log file for actions (behind the scenes in WebLogic Server)
\nServers -> AdminServer -> Debug<\/strong> Select WebLogic<\/strong> -> Security <\/strong>and click on Enable <\/strong>button<\/p>\n

You can see debug messages in $DOMAIN_HOME\/servers\/AdminServer\/logs<\/strong><\/p>\n

.<\/strong><\/p>\n

References <\/u><\/strong><\/p>\n