{"id":6610,"date":"2013-11-04T21:41:34","date_gmt":"2013-11-05T01:41:34","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=6610"},"modified":"2013-11-04T21:50:24","modified_gmt":"2013-11-05T01:50:24","slug":"identity-propagation-between-two-weblogic-domains-cross-domain-security-vs-global-trust","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/11\/04\/identity-propagation-between-two-weblogic-domains-cross-domain-security-vs-global-trust\/","title":{"rendered":"Identity Propagation between two WebLogic Domains : Cross Domain Security VS Global Trust"},"content":{"rendered":"

I discussed about WebLogic Domain<\/a>\u00a0earlier, In this post I am going to discuss on configuring trust<\/strong> between two WebLogic Domains<\/strong> i.e. Cross Domain Security<\/strong> or Global Trust <\/strong>so that identity<\/strong> can be propagated across WebLogic Domains.<\/p>\n

 <\/p>\n

If there are two WebLogic Domains with same user (principal<\/strong>) like user1<\/strong> then these two users (principal<\/strong>) are differnet and can’t be used in another domain, unless there is trust configured<\/strong> between these two WebLogic Domain. If you want to propagate identity<\/strong> across WebLogic Domains (from one WebLogic domain to another<\/span>) then you must configure trust<\/strong> between these two Weblogic Domains.<\/p>\n

There are two types of trust<\/strong> between two or more WebLogic Domains (Note<\/strong> : Prior to WebLogic 9.2 there was only one way i.e. Global Trust<\/strong><\/span>)<\/p>\n

A. Global Trust<\/strong> – This is the only supported<\/strong><\/span> option for RMI<\/strong> and EJB<\/strong>
\nB. Cross Domain Security<\/strong> – Use this for JMS<\/strong>, JTA<\/strong>, MDB<\/strong> or WAN replication sub system (don’t use this option for RMI\/EJB<\/span>)<\/p>\n

 <\/p>\n

Global Trust <\/strong>VS Cross Domain Security<\/strong><\/span><\/p>\n

1. Global Trust<\/strong> is transitive<\/strong> and symmetric<\/strong> i.e. If there is global trust between WebLogic Domain A<\/strong> & B<\/strong>, and there is Global Trust between webLogic Domain B<\/strong> & C<\/strong> then there will be trust between Domain A<\/strong> & C<\/strong>. In cross domain security<\/strong>, if there is trust between A & B and B & C then there will not<\/strong><\/span>\u00a0trust configured between A & C automatically.<\/p>\n

2.<\/strong> The domain name involved in Cross Domain Security<\/strong> must be unique<\/p>\n

3. Global Trust <\/strong>can be used for all type of sub systems like RMI<\/strong>, EJB<\/strong>, JMS<\/strong>, JTA<\/strong>, MDB<\/strong>, and WAN<\/strong> where as Cross Domain Security<\/strong> can’t<\/span> be used for RMI<\/strong> or EJBs<\/strong> (you can use cross domain security<\/strong> \u00a0or global trust<\/strong> for JMS, JTA, MDB or WAN)<\/p>\n

4.<\/strong>\u00a0Global Trust<\/strong> between WebLogic domains has the potential to open the servers up to man-in-the-middle<\/strong> attacks. You must use firewalls or dedicated network channels to restrict access in WebLogic Domains (with Global Trust configured)<\/p>\n

 <\/p>\n

To configure Global Trust<\/strong><\/span>
\nGlobal Trust across WebLogic Domains : This is old style of configuring trust between two WebLogic Domains where you simply change the credential (domain credential) in two WebLogic Domains to be Same (<Domain Name><\/strong>\u00a0: Security<\/strong> -> General<\/strong> -> Advanced<\/strong>\u00a0: Credential<\/strong>).<\/p>\n

 <\/p>\n

1.<\/strong> Change the credential of Domain to a known value in Domain A
\n2.<\/strong> Change the credential of Domain to same value (as used in domain A) in Domain B<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

For full steps to configure trust between two domains using Global Trust<\/strong> click here<\/a><\/p>\n

<\/div>\n

.<\/p>\n

To configure Cross Domain Security<\/strong><\/span> : In this type of trust between two WebLogic Domains
\n1.<\/strong> Enable cross domain security checkbox next to “Cross Domain Security Enabled<\/strong>” in <WebLogic Domain<\/strong>> : Security<\/strong> -> General<\/strong> for both Domain A<\/strong> and Domain B<\/strong><\/p>\n

2.<\/strong> You create user<\/strong> in WebLogic Domain A (and assign it to group CrossDomainConnectors<\/strong>) using Security Realm<\/strong>\u00a0->\u00a0myrealm<\/strong>\u00a0->\u00a0Users and Groups<\/strong>\u00a0->\u00a0New<\/strong><\/p>\n

<\/div>\n

3.<\/strong> In Domain B, create Credential Mapping<\/strong> with “Use Cross-domain protocol<\/strong>” option (Security Realm<\/strong> -> myrealm<\/strong> -> Credential Mapping<\/strong> -> New<\/strong>)<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

4.<\/strong> repeat step 2 in Domain B and Step 3 in Domain B<\/p>\n

Follow the full steps to configure cross domain security across two servers here<\/a><\/p>\n

 <\/p>\n

Related\/References<\/strong><\/span><\/p>\n