Moving to Production

This tutorial describes how to secure Enterprise JavaBean (EJB) resources by using the Administration Console. It includes step-by-step procedures for creating scoped roles and security policies at various levels in the EJB resource hierarchy.

Prerequisites

Procedure

To secure Enterprise JavaBean (EJB) resources by using the Administration Console:

Step 1: Create scoped roles and grant the scoped roles to groups.

In the left Domain Structure pane of the Administration Console, click MedRecDomainDeployments.
In the Deployments table in the left pane, expand medrecEar.
Under the Modules category, click the sessionEjbs EJB module.
Select the SecurityRoles tab.

This page displays all the scoped roles currently defined in the WebLogic Role Mapping provider's database.

Selecting this option enables you to create a security role that is scoped to this particular EJB JAR. Thereafter, the scoped role can be used in a security policy for this EJB JAR.

Click New.
In the Name field, enter MedRecSessionEJBPatient.
Do not change the default value of the Provider Name field.
Click OK.
In the EJB Module Roles table, click MedRecSessionEJBPatient.
In the Role Conditions section, click Add Conditions.
In the Predicate List drop-down list box, select Group.
Click Next.
In the Role Argument Name field, enter MedRecPatients.

Note: You created the MedRecPatients group as part of Tutorial 16: Creating Users, Groups, and Global Security Roles. Recall that user larry@bball.com is the only user in this group.

Click Add.
Click Finish.
Click Save.

The Role Conditions sections includes the entry Group MedRecPatients.

Repeat steps 1- 16 to create the scoped role named MedRecSessionEJBAdmin and grant this scoped role to the MedRecAdmins group.

Note: You created the MedRecAdmins group as part of Tutorial 16: Creating Users, Groups, and Global Security Roles. Recall that user admin@avitek.com is the only user in this group.

Step 2: Secure the sessionEjbs JAR.

In the left Domain Structure pane of the Administration Console, click MedRecDomainDeployments.
In the Deployments table in the left pane, expand medrecEar.
Under the Modules category, click the sessionEjbs EJB module.
Select the SecurityPolicies tab.

From this page you can create a security policy at the EJB JAR level, which includes all EJBs within the JAR, and all methods within those EJBs.

Click Add Conditions.
In the Predicate List drop-down list, select Role.
Click Next.
In the Role Argument Name field, enter MedRecSessionEJBPatient.
Click Add.
Click Finish.
Click Save.

The Policy Conditions section includes the entry Role MedRecSessionEJBPatient.

The Overwritten Policy section includes the entry Group everyone.

By defining this security policy for the sessionEjbs JAR, you are overriding any security policies that have already been defined for the EJB resource type. For example, if you had previously specified that the entire medrecEar application can be accessed only by the MedRecAdmin role, then the Overwritten Policy section would include the text Role MedRecAdmin.

However, in this case you are only overwriting the default security policy (Group everyone).

For more information about default security policies, see Default Security Policies in Securing WebLogic Resources.

Step 3: Attempt to access an EJB in the SessionEJB JAR.

Open a new Web browser and type http://host:7101/admin, where host refers to the computer hosting MedRecServer. If your browser is on the same computer, then you can use the URL http://localhost:7101/admin.
In the User Name field, type admin@avitek.com, and in the Password field, type weblogic, then click Login.

Remember that in Tutorial 17: Securing URL (Web) Resources Using the Administration Console, you granted the MedRecAdmin role permission to access the admin Web Application. Because admin@avitek.com has been assigned the MedRecAdmin role (via the MedRecAdmins group), the admin@avitek.com user is thus allowed to log in to the admin Web Application.

On the Administration Tasks page, click the View Pending Requests link.

The browser returns the following error:

[EJB:010160]Security Violation: User: 'admin@avitek.com' has insufficient permission to access EJB: type=<ejb>, application=medrecEar, module=sessionEjbs, ejb=AdminSessionEJB, method=findNewUsers, methodInterface=Remote, signature={}.

The error is displayed because access to the findNewUsers() method in AdminSessionEJB, an EJB within the sessionEjbs JAR you previously secured, is needed to view pending requests. User admin@avitek.com is not granted the MedRecSessionEJBPatient scoped role that was used to create the security policy, and therefore is not granted access.

Step 4: Secure the AdminSessionEJB.

In the left Domain Structure pane of the Administration Console, click MedRecDomainDeployments.
In the Deployments table in the left pane, expand medrecEar.
Under the EJBs category, click the AdminSessionEJB EJB module.
Select the SecurityPolicies tab.

From this page you can create a security policy for the specified EJB, either at the EJB level (meaning the security policy will apply to all methods within the EJB), or a particular method within the EJB.

In the EJB Component Methods drop-down list, ensure that the default ALL is selected.
Click Add Conditions.
In the Predicate List drop-down list, select Role.
Click Next.
In the Role Argument Name field, enter MedRecSessionEJBAdmin.
Click Add.
Click Finish.
Click Save.

The Policy Conditions section includes the entry Role MedRecSessionEJBAdmin.

The Overwritten Policy section includes the entry Role MedRecSessionEJBPatient.

By defining this security policy for AdminSessionEJB, you are overriding the security policy that has already been defined for the EJB JAR in Step 2: Secure the sessionEjbs JAR. Specifically, you are overriding the inherited policy statement of Role MedRecSessionEJBPatient.

Step 5: Attempt to access AdminSessionEJB.

Instead of displaying the error page, the browser now displays the list of pending requests.

This result occurs because user admin@avitek.com has been granted the MedRecEJBSessionAdmin scoped role. This scoped role was used to create the security policy for AdminSessionEJB, the EJB containing the findNewUsers() method that is needed to view pending requests.

Step 6: Secure the findNewUsers() EJB method.

In the left Domain Structure pane of the Administration Console, click MedRecDomainDeployments.
In the Deployments table in the left pane, expand medrecEar.
Under the EJBs category, click the AdminSessionEJB EJB module.
Select the SecurityPolicies tab.

Using the EJB Component Methods drop-down list, select findNewUsers() - REMOTE.
Click Add Conditions.
In the Predicate List drop-down list, select Role.
Click Next.
In the Role Argument Name field, enter MedRecSessionEJBPatient.

You defined this scoped role on SessionEJB, but because the findNewUsers() method is a component of AdminSessionEJB (itself a component of SessionEJB), you can also use it here.

Click Add.
Click Finish.
Click Save.

The Policy Conditions section includes the entry Role MedRecSessionEJBPatient.

The Overwritten Policy section includes the entry Role MedRecSessionEJBAdmin.

By defining this security policy on the findNewUsers() method, you are overriding the security policy that has already been defined for AdminSessionEJB in Step 4: Secure the AdminSessionEJB.. Specifically, you are overriding the inherited policy statement of Role MedRecSessionEJBAdmin that is shown when ALL is selected from the EJB Component Methods drop-down list.

Step 7: Attempt to access the findNewUsers() EJB method.

The browser displays an error page. This result occurs because only users granted the scoped role MedRecSessionEJBPatient can access the findNewUsers() method, which is needed to view pending requests. User admin@avitek.com is not granted the scoped role that was used to create the security policy, and therefore is not granted access.

Step 8: Optionally, remove the EJB security policies.

The security policies configured in this tutorial do not mimic the out-of-the-box security configuration of the MedRec application, but rather, simply provide examples of how you can secure EJB policies if you choose to do so in your own applications. The configured security policies actually interfere with the correct functioning of the MedRec application, so if you want to run the application without problems, you should remove the security policies as described in the following procedure.

In the left Domain Structure pane of the Administration Console, click MedRecDomainDeployments.
In the Deployments table in the left pane, expand medrecEar.
Under the Modules category, click the sessionEjbs EJB module.
Select the SecurityPolicies tab.
In the Policies Conditions table, check Role MedRecSessionEJBPatient.
Click Remove.
Click Save.
In the left pane, click MedRecDomainDeployments.
In the Deployments table in the right pane, navigate to the AdminSessionEJB EJB module of the medrecEar application.
Select the SecurityPolicies tab.
In the EJB Component Methods drop-down list, select ALL.
In the Policy Conditions table, check Role MedRecSessionAdmin.
Click Remove.
Click Save.
In the EJB Component Methods drop-down list, select findNewUsers() - REMOTE.
In the Policy Conditions table, check Role MedRecSessionEJBPatient.
Click Remove.
Click Save.

Best Practices

Do not use blank spaces, commas, hyphens, or any characters in this comma-separated list for scoped role names: \t, < >, #, |, &, ~, ?, ( ), { }. Role names are case sensitive. The proper syntax for a security role name is as defined for an Nmtoken in the Extensible Markup Language (XML) recommendation. The BEA convention is that security role names are singular.
Try to avoid creating global roles and scoped roles with the same name. However, if you have a valid reason for doing this, know that the scoped role will override the global role if used in Role policy condition.
Scoped roles can be used in security policies from the level in the hierarchy where they are defined and below.
Create policy statements based on your organization's established business procedures.
When creating new security policies, look for policy statements in the Overwritten Policy Statement box of the Policy Editor page. If inherited policy statements exist, you will be overriding them.
Remember that more-specific security policies override less-specific security policies. For example, a security policy on an EJB method overrides a security policy on the same EJB. Take care when overriding with less restrictive security policies (that is, giving a wider set of users access to a smaller set of components or WebLogic resources).
You can delete all security settings for an application (or module) by deleting it entirely from the WebLogic Server domain and then redeploying it.

The Big Picture

This tutorial shows you how to secure application and various Enterprise JavaBean (EJB) resources. The examples here do not reflect the security configuration of the out-of-the-box MedRec application. However, the full MedRec application uses these same principles (as well as programmatic security) to secure EJB resources for both MedRec administrators and patients.

Avitek Medical Records Development Tutorials