EJB Security on WebLogic

EJB Security has been tested for WebLogic 5.1, 6.1, 7.01, 8.1

The JAAS security is supported only by JProxy Commercial Release!

To execute the test you have to provide your own configuration for LoginModule. 
Here is explanation how to do it. 

Here is a content of mylogin.config (only 2 lines):
----------------------------------
mylogin {
   weblogic.security.auth.login.UsernamePasswordLoginModule required debug=false; };
----------------------------------

The file has to be accessible by JRE in which WebLogic is executed!!!!!!

Weblogic has its own JRE:
  WebLogic 8.1: WEBLOGIC_HOME/jdk141_03/jre/
  WebLogic 7: WEBLOGIC_HOME/jdk131_06/jre/

If it uses the JRE then mylogin.config must be placed in 
WEBLOGIC_HOME/jdk141_03/jre/lib/security/

Check what JRE is used by WebLogic by analizing WebLogic output during start-up.

The other option could be JRE in $JAVA_HOME/jre/. 

Also add to java.security absolute path to mylogin.config:
line: login.config.url.1=file:/bea81/jdk141_03/jre/lib/security/mylogin.config

Be sure that path is correct. 
Note that this test case assumes that %JAVA_HOME% is not used because of WebLogic's JRE utilized.

Set in proxyservlet.war/WEB-INF/classes/com/jproxy/proxy/proxy.properties

following properties: 
com.jproxy.proxy.tunnel.invocation.interceptor = com.jproxy.proxy.providers.JaasInvocationInterceptor
com.jproxy.proxy.jaas.configuration.name = mylogin

Redeploy JProxy Serer. 

Now everything is setup. 
For testing use our samples that we sent previously. 

Also check JAAS sample: 
  for WebLogic 8.1: WEBLOGIC_HOME/weblogic81/samples/server/examples/src/examples/security/jaas
  for WebLogic 7: WEBLOGIC_HOME/weblogic700/samples/server/src/examples/security/jaas


To test JProxy with EJB security on WebLogic please use TestSessionBean sample 
from JProxy distribution located in samples.jar. 
 
This is a helpful link to WebLogic security: http://e-docs.bea.com/wls/docs61/security/concepts.html
 
To execute TestSessionBean "Performance" sample:
%JAVA_HOME%\bin\java -cp samples.jar;proxyclient.jar;j2api.jar \
  com.jproxy.samples.ejb.test.PerformanceClient \
  -Djava.naming.security.principal=admin \
  -Djava.naming.security.credentials=12345678 \
  loops=1 bytes=100 threads=1 mode=EJB url=localhost

Notice that user name and password specified after class name as main-method argument : 
-Djava.naming.security.principal=admin
-Djava.naming.security.credentials=12345678

The example assumes that there is a user "admin" with password "12345678" exists in WebLogic realm. 

Here are deployment descriptors from samples.jar EJB archive utilizing EJB security:

proxy.ear/samples.jar/META-INF/ejb-jar.xml
===============================================================
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Enterprise JavaBeans 2.0//EN" "http://java.sun.com/dtd/ejb-jar_2_0.dtd">
<!-- Deployment descriptor for jproxy test beans -->
<ejb-jar>
  <enterprise-beans>
    <session>
      <description>The JProxy Test Session Bean</description>
      <ejb-name>TestSessionBean</ejb-name>
      <home>com.jproxy.samples.ejb.test.ISessionHome</home>
      <remote>com.jproxy.samples.ejb.test.ISession</remote>
      <ejb-class>com.jproxy.samples.ejb.test.SessionEJB</ejb-class>
      <session-type>Stateless</session-type>
      <transaction-type>Container</transaction-type>
    </session>
  </enterprise-beans>
 
  <assembly-descriptor>

    <!-- uncomment for EJB security testing -->
    <security-role>
      <role-name>administrators</role-name>
    </security-role>
 
    <method-permission>
    <role-name>administrators</role-name>
      <method>
        <ejb-name>TestSessionBean</ejb-name>
        <method-name>*</method-name>
      </method>
    </method-permission>

  </assembly-descriptor>

</ejb-jar> 
===============================================================
 
 
proxy.ear/samples.jar/META-INF/wblogic-ejb-jar.xml
===============================================================
<?xml version="1.0"?>
 
<!DOCTYPE weblogic-ejb-jar PUBLIC
'-//BEA Systems, Inc.//DTD WebLogic 6.0.0 EJB//EN' 'http://www.bea.com/servers/wls600/dtd/weblogic-ejb-jar.dtd'>
 
<weblogic-ejb-jar>
  <weblogic-enterprise-bean>
    <ejb-name>TestSessionBean</ejb-name>
    <jndi-name>TestSessionBean</jndi-name>
  </weblogic-enterprise-bean>
 
<!-- to test EJB security uncomment below --> 
<security-role-assignment>
  <role-name>administrators</role-name>
  <principal-name>admin</principal-name>
  <principal-name>system</principal-name>
</security-role-assignment>
 
</weblogic-ejb-jar> 
===============================================================
 

You may want specify security for some method in <method-permission> tag 
in ejb-jar.xml of samples.jar. 
For instance Performance Test uses method "getServerTime in TestSessionBean":
...
    <method-permission>
      <role-name>administrators</role-name>
      <method>
        <ejb-name>TestSessionBean</ejb-name>
        <method-intf>Remote</method-intf>
        <method-name>getServerTime</method-name>
        <!-- method-params>
          <method-param></method-param>
        </method-params -->
      </method>
    </method-permission>
...

There is already default "Administrators" group (role) in the WebLogic. 
Because group and user names are case sensitive, you have to create 
new group "administrators" and user "admin" from WebLogic console. 
