10 Managing the RDBMS Security Store

Specifying Database Connection Properties

When configuring the RDBMS security store in either the Configuration Wizard or WLST, you need to specify or configure the following:

• RDBMS type

  The following RDBMS systems are supported for containing the RDBMS security store:

  • Oracle 9i, 10g, and 11g

  • MS-SQL 2000 and 2005

  • DB2 9.2 and 9.5

  • PointBase RDBMS 5.7, included with WebLogic Server

    Note:

    When you use the Configuration Wizard to configure the RDBMS security store, the Configuration Wizard provides a drop-down list for selecting the database you want to use. The databases appearing in this drop-down list are not exclusive to only those supported for the RDBMS security store. Make sure you choose a database that is supported for this purpose. (See Oracle Fusion Middleware Supported System Configurations at http://www.oracle.com/technology/software/products/ias/files/fusion_certification.html for the most up-to-date list.)

• JDBC driver and class name for connecting to the RDBMS

• RDBMS name, host, port, and URL

• Username and password of the domain user who can access the RDBMS system

• Optionally, any properties that need to be passed to the RDBMS system

The parameters that you specify in the JDBC driver connection properties attribute must be a comma-separated list. The following examples show the use of WLST to configure the database connection properties for Oracle, MS-SQL, and DB2.

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('ortiz') 
rdbms.setPassword('weblogic') 
rdbms.setConnectionURL('jdbc:bea:oracle://avitek21:1521') 
rdbms.setDriverName('weblogic.jdbc.oracle.OracleDriver') 
rdbms.setConnectionProperties('user=ortiz,portNumber=1521,SID=pint101a,serverName=avitek21') 

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('garnett') 
rdbms.setPassword('weblogic') 
rdbms.setConnectionURL('jdbc:bea:sqlserver://avitek6:1433') 
rdbms.setDriverName('weblogic.jdbc.sqlserver.SQLServerDriver') 
rdbms.setConnectionProperties('user=garnett,portNumber=1433,databaseName=wls3,serverName=avitek6') 

create('base_domain','SecurityConfiguration') 
cd('/SecurityConfiguration/base_domain') 
a=get('DefaultRealm') 
cd('Realm/myrealm') 
rdbms = create("myRDBMSSecurityStore", "RDBMSSecurityStore") 
rdbms.setUsername('brady') 
rdbms.setPassword('weblogic') 
rdbms.setConnectionURL('jdbc:bea:db2://avitek3:50000') 
rdbms.setDriverName('weblogic.jdbc.db2.DB2Driver') 
rdbms.setConnectionProperties('user=brady,portNumber=50000,databaseName=wls,serverName=avitek3,batchPerformanceWorkaround=true') 

Testing the Database Connection

During the process of configuring the RDBMS security store via the Configuration Wizard, you are presented with the option of testing the database connection. Oracle strongly recommends using this option because it can verify that the connection is set up properly. If there were a problem with the database connection, you might not be able subsequently to boot the domain if the security providers that control access to that domain are unable to obtain the necessary security policies.

For information about configuring the RDBMS security store via the Configuration Wizard, see "Customizing the Environment" in Oracle WebLogic Server Creating WebLogic Domains Using the Configuration Wizard.

Configuring JMS Connection Recovery in the Event of Failure

Normally, the WebLogic Security Service contained in each WebLogic Server instance in a multi-node domain connects at startup to the JMS server. If a security provider that uses the RDBMS security store makes a change to its security data, all WebLogic Server instances are notified via JMS, and the local caches used by the WebLogic Security Service in each server instance are synchronized to that change.

If the JMS connection fails in a WebLogic Server instance that has been successfully started, the WebLogic Security Service associated with that server instance starts the JMS connection recovery process. The recovery process sleeps one second between reconnect attempts. The recovery process is stopped if the JMS connection failure persists after the number of reconnect attempts with which the JMSExceptionReconnectAttempts property has been configured is reached. No further reconnect attempts are made: If a change is made to the security data in one WebLogic Server instance, the local caches managed by the WebLogic Security Service in other WebLogic Server instances are not synchronized to that change. However, if the JMS connection is successfully recovered by other means (such as a server reboot), those caches become synchronized.

If the JMS connection is not successfully started at the time a WebLogic Server instance is booted, a timer task that makes reconnect attempts is automatically started. The timer task is cancelled once the connection is successfully made. Two system properties may be configured for this timer task:

• com.bea.common.security.jms.initialConnectionRecoverInterval

  Specifies the delay, in milliseconds, before the connection recovery task is executed. The default value is 1000, which causes the connection recovery process to be executed after a delay of one second.

• com.bea.common.security.jms.initialConnectionRecoverAttempts

  Specifies the maximum number of reconnect attempts that can be made prior to cancelling the timer task. The default value is 3600, which causes the timer task to be cancelled once 3600 reconnect attempts have been made. No further reconnect attempts are made.

You can calculate the maximum connection polling duration by multiplying the values specified by each of the preceding system properties. For example, multiplying the default values of these two properties yields a maximum polling duration of one hour (1000 millisecond delay multiplied by 3600 reconnect attempts).