C Customizing Role-based Security for SOA Applications

A default realm (MyRealm) is created for the SOA domain with one default user - 'weblogic'. The password for the weblogic user can be chosen when prompted by the setup.bat/sh script ( in case on non-HA installation ) setupDomain.bat/sh script ( in case on HA installation ).

The other scripts will prompt for this password for authentication to connect to the admin server when they are executed.

The SOA applications (BPEL/ESB/OWSM/Rule Author) use role-based authentication. The roles used by these applications are mapped to a group called 'SoaGroup' in the default realm. SoaGroup, by default, contains only one user - 'weblogic'. Thus, the 'weblogic' user can access the Admin console and all the SOA applications.To map to an existing group of users to the SOA applications for authentication/authorization use the overriding property SECURITY_GROUP_NAME in SOADomain.properties prior to running setup scripts.

Also, by default, the security role to user/group mapping for the SOA applications is packaged as part of the deployment descriptors. The security model of 'DDOnly' is configured by default.

In order to configure the security roles, users/groups from the WebLogic console, use the SECURITY_MODEL property of SOADomain.properties. The permitted values for SECURITY_MODEL are:

• DDOnly

• CustomRoles

• CustomRolesAndPolicy

• Advanced

Refer to WebLogic Documentation for details on the above security models.