In WebLogic you can use database tables as authentication provider for
your web applications. In these tables you can store your application
users with its roles. WebLogic will use these tables for your
application authentication. WebLogic even provides you a web interface
where you can add or change users / roles.
First we need to have some authorization tables. I will use the user and roles tables of JHeadstart. You can download the sql script from here.
Now we can add the SQL authenticator provider in WebLogic. First we need to create a datasource for the database connection and remember the datasource name ( not the jndi name) We needs this value for the provider. (see how to create a datasource in this article).
Select the Security Realms link:
then select the default realm "myrealm"
and go to providers tab.
Here we can create a new authentication provider.
Select SQLAuthenticator as Type
Select your just created provider and change the Control flag to
sufficient else the provider will never be used.
Change the Control flag of the default authenticator from required to sufficient else your newly created provider will never be used.
After this we can go to the provider specific tab where we
can add the details of the provider. We need to fill in the datasource name, select a password algorithm and add many SQL statements.
Here are my settings for the jheadstart tables. Go to this folder\JDeveloper\system11.1.2.0.38.60.17\DefaultDomain\config
and change the config.xml file where you should find your values shown like bellow:
Replace these values by the content of this file.
Now, We need to restart the WebLogic server. After the reboot we can go to the User and Group tab of your default security realm where we can change or add users and roles. Here is an overview where we can see SKING
When we select SKING we can add roles to this user.
Then configure the policy grants
No Automatic Grant
Select when you intend to define an explicit ADF security policy for each ADF task flow and web page. After you run the wizard, you can use the overview editor for ADF security policies that you display on the jazn-data.xml file to define explicit security policies.
Grant to Existing Objects Only
Select when you want JDeveloper to create ADF security policies for the test-all application role and you want these policies to apply to all your application's existing ADF task flows and web pages. This option will appear disabled if you previously ran the wizard and already enabled grants to all objects.
Grant to All Objects
Select when you want JDeveloper to create ADF security policies for the test-all application role and you want these policies to apply to every ADF task flow and web page that developers create.
The last step in the wizard is to select your welcome page upon successful authentication.
First we need to have some authorization tables. I will use the user and roles tables of JHeadstart. You can download the sql script from here.
Now we can add the SQL authenticator provider in WebLogic. First we need to create a datasource for the database connection and remember the datasource name ( not the jndi name) We needs this value for the provider. (see how to create a datasource in this article).
Select the Security Realms link:
then select the default realm "myrealm"
and go to providers tab.
Here we can create a new authentication provider.
<sec:authentication-provider xsi:type="wls:sql-authenticatorType">
<sec:name>DB_users</sec:name>
<sec:control-flag>SUFFICIENT</sec:control-flag>
</sec:authentication-provider>
Replace these values by the content of this file.
Now, We need to restart the WebLogic server. After the reboot we can go to the User and Group tab of your default security realm where we can change or add users and roles. Here is an overview where we can see SKING
Now go to your application and apply ADF security.
Select the authentication type
No Automatic Grant
Select when you intend to define an explicit ADF security policy for each ADF task flow and web page. After you run the wizard, you can use the overview editor for ADF security policies that you display on the jazn-data.xml file to define explicit security policies.
Grant to Existing Objects Only
Select when you want JDeveloper to create ADF security policies for the test-all application role and you want these policies to apply to all your application's existing ADF task flows and web pages. This option will appear disabled if you previously ran the wizard and already enabled grants to all objects.
Grant to All Objects
Select when you want JDeveloper to create ADF security policies for the test-all application role and you want these policies to apply to every ADF task flow and web page that developers create.
The last step in the wizard is to select your welcome page upon successful authentication.
You do not need to modify
the role mapping in weblogic.xml. The default is perfectly fine:
<weblogic-web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns="http://www.bea.com/ns/weblogic/weblogic-web-app"
xsi:schemalocation="http://www.bea.com/ns/weblogic/weblogic-web-app http://www.bea.com/ns/weblogic/weblogic-web-app/1.0/weblogic-web-app.xsd">
<security-role-assignment>
<role-name>valid-users</role-name>
<principal-name>users</principal-name>
</security-role-assignment>
</weblogic-web-app>
For each group in your SQLAuthenticator provider in weblogic console,
create an equivalent application role in jazn.xml, and recreate those
roles in the Enterprise Roles in jazn.xml. In jazn,xml make enterprise
role as member of the appropriate application role. There is no need to
create user in jazn.xml file. Creating role will do the work.
Make sure to specify your welcome page in web.xml
Now you can test your application.
