WebLogic authentication debugging

OGh Oracle Fusion Middleware Experience 2016 bij FIGI Zeist
Maarten Smeets, 16-02-2016
Debugging WebLogic authentication

Introduction
• About AMIS
– Located in the Netherlands
– Oracle Award winning partner
• About me
– Senior Oracle Integration Consultant
– Experience with Oracle SOA Suite since 2007
– Well certified (SOA, BPM, Java, SQL,
PL/SQL among others)
– Author more than 100 blog articles
(http://javaoraclesoa.blogspot.com)
@MaartenSmeetsNL
https://nl.linkedin.com/in/smeetsm

4
Oracle Virtual Technology Summit
http://www.oracle.com/technetwork/community/developer-day/index.html
March 8, 2016, 18:30:00 CET
• Database Application Development
• Oracle DB12c Performance
• MySQL
• Java EE, Microservices and JPA
• All about Java 8!
• The Internet of Things
• WebLogic 12.2.1 and Java EE
• Operating Systems and Virtualization
• Storage,SPARC, and Software
Development

Agenda
• Oracle Identity Stores
• Introduction Oracle Platform Security Services (OPSS)
• What to debug
• How to debug WebLogic authentication
• How to debug application authentication

6
Why use an external Identity Store?
Application
WLS SOA
WLS OSB
WLS ADF
WLS WCC
• An application uses company internal users
• Often internal users are already present in an Identity Store
• Management organization in place
• Single environment to manage users
• Single account per user

7
Introduction OPSS
Oracle Identity Store solutions
• Oracle Unified Directory
– Embedded Berkeley Database
– LDAP proxy
– Much faster read/write than ODSEE
– Provides LDAP virtualization
– Elastic scaling
– Strategic Directory Server product
– Designed to address current and future
on-premise, mobile, and cloud needs
• Oracle Directory Server Enterprise
Edition
– ODSEE 5.2 and 6.3 are in Sustaining Support
– No new fixes will be created
• Oracle Virtual Directory
– Provides virtualization of different sources
– OUD does not replace OVD
• Oracle Internet Directory
– Uses external Oracle DB
– Used with Fusion Applications
https://blogs.oracle.com/OracleIDM/entry/why_customers_should_upgrade_directory

Introduction OPSS
Identity
Store
Providers
Authentication Authorization
Credential Store
Framework
User / Role
Service Provider Interface Layer
OPSS APIs
WebLogic Server
JavaEE application Java SE application

What to debug
Identity
Store
WebLogic Console
Application
Authentication
API
Virtualization
Platform security
jps-config.xml
jps-config-jse.xml
system-jazn-data.xml
config.xml web.xml
weblogic.xml
LDAP queries
SSL/TLS
Role mappings
Organizational Units
Authentication
provider

13
Debug Weblogic authentication
using an external client
• Using an external client
Apache Directory Studio

14
Debug WebLogic authentication
Embedded LDAP

15
Embedded LDAP
• Login using:
Bind DN / User: cn=Admin
• Running by default on the
AdminServer port
• Check out cn=Config for
LDAP server properties

16
Embedded LDAP
• Notice the use of dynamic
groups

17
Embedded LDAP
• Notice the use of dynamic
groups

18
Authentication provider configuration
• Select the authentication provider (as specific as possible)
• JAAS Control flags
• LDAP connection details
• LDAP search behavior
– Users
– Static groups
– Dynamic groups
• Cache settings

19
using Weblogic Console
• JAAS Control flags
– SUFFICIENT: if authentication is passed, no other authentication
providers are evaluated. If it fails, they are
– REQUIRED: the authentication provider is always called and
authentication must succeed
– OPTIONAL: passing authentication of this provider
is optional. If all providers are optional, one needs to pass
– REQUISITE: authentication has to succeed on
this provider. After that providers of lower priority are evaluated

20
Cache settings
• How to uniquely identify an LDAP entry. The GUID Attribute
• The GUID Attribute is used as cache key
• Provider specific
– OUD, OpenLDAP, ApacheDS: entryuuid
– Active Directory: objectguid
– OVD, OID: orclguid
• Misconfiguration can lead to first login fail, second login success (cache issues)

21
• Connection to external
provider works
• Server trust is
established
• User query works
• Validating
authentication details
works

22
• Dynamic group object class works
• Group Base DN works
• User Dynamic Group DN Attribute works
• Dynamic Group Name Attribute works

23
using log files
LDAP connections
LDAP queries

24
Demo
• Embedded LDAP
• How to create a user in an LDAP server
• How to configure WebLogic server to use the server
• Debug authentication using the console
• Debug the authentication using the log files

Debug application authentication
Identity
Store
WebLogic Console
Application
Authentication
API
Authentication
provider
Virtualization
Platform security
jps-config.xml
jps-config-jse.xml
config.xml web.xml
weblogic.xml
LDAP queries
SSL/TLS
Role mappings
Organizational Units

27
OPSS configuration files
in $DOMAIN_HOME/config/fmwconfig
• Java Platform Security: jps-config.xml (Java EE), jps-config.jse.xml (Java SE) login modules,
authentication providers, authorization policy providers, credential stores and auditing services
• jazn-data.xml, system-jazn-data.xml
– users, groups and authorization policies
• cwallet.sso
– credentials used by the application
• adapters.os_xml
– LibOVD plugin configuration

28
LibOVD
• Present since 11.1.1.4. Seen several patches since then. Lightweight OVD alternative supplied with
WebLogic Server.
• FMW components which use OPSS can only use the first LDAP authentication provider
LibOVD provides virtualization
• Configuration
Edit <DOMAINDIR>/config/fmwconfig/jps-config.xml manually or from Enterprise Manager
Plugin configuration in <DOMAINDIR>configfmwconfigovddefaultadapters.os_xml
http://fusionsecurity.blogspot.nl/2012/06/libovd-when-and-how.html

29
LibOVD configuration
• <DOMAINDIR>/config/fmwconfig/jps-config.xml
Provides login modules, authentication providers, credential stores

30
LibOVD configuration
• The OPSS API only queries static groups by default. Not dynamic groups.
• Use the LibOVD dynamic group plugin to present dynamic groups like static groups
(configuration in <DOMAINDIR>configfmwconfigovddefaultadapters.os_xml)
• Requires that the dynamic group has both the GroupOfUniqueNames and GroupOfURL
objectclasses
• Only one structural class is allowed per LDAP object
• Fix by setting the superclass of GroupOfURLs to GroupOfUniqueNames
http://www.ateam-oracle.com/oracle-webcenter-and-dynamic-groups-from-an-external-ldap-server-part-1-of-2/

31
LibOVD debugging
• Can be used when ADFLogger is
used in application
• Can be used for specific Weblogic
Server component debugging such
as oracle.ods.virtualization for
LibOVD

32
ADF Security
• Application configuration files
– web.xml
Defines authorization constraints (valid-users)
and set-up OPSS policy provider (JpsFilter)
– weblogic.xml
Maps valid-users to OPSS principal users

33
Demo
• Use basic authentication in an ADF application

34
ADF Security
• Application configuration files
– jazn-data.xml
Contains development users / roles
Application roles are granted to enterprise roles / users (from the OPSS API which uses the authorization provider).
Resource permissions are granted to application roles or enterprise roles.
– Test with:
Java: ADFContext.getCurrent().getSecurityContext().isUserInRole(“role”)
EL: #{securityContext.userInRole[‘role']}
Users
Enterprise
roles
Application
roles
Permissions
Grants
weblogic.xml jazn-data.xml

35
ADF Security
• <DOMAINDIR>/config/fmwconfig/
– OOTB file based policy store
– Users, groups, authorization policies
– CredentialAccessPermission
– Change while WebLogic is down or from
EM!

36
JVM parameters
• JVM parameters:
– -Djps.auth.debug=true to get AccessControlException among other useful messages
– -Djps.auth.debug.verbose=true to get a lot of debug messages
http://docs.oracle.com/cd/E23943_01/core.1111/e10043/jpsprops.htm#JISEC2229

37
Business Process Management
• Authenticate with a user
• User is member of (authentication provider)
groups
• Groups are granted (application) roles
and organization units
• Business Process Management uses application
roles and organization units

38
The Identity Service
• Can I authenticate the user?
– authenticateUser
• Can I determine groups?
– getGroups
http://HOST:PORT/integration/services/IdentityService/identity?WSDL
<ORACLE_HOME>/soa/soa/modules/oracle.soa.workflow_11.1.1/bpm-services.jar
• Can I determine granted roles?
– getGrantedRolesToUser
• Can I determine organizational units?
– use the Java API

39
Conclusion
• Many debugging options available
– Looking at WebLogic Console or application behavior
– Using an external client for your authentication provider
– Debug logging in WebLogic Server console
– Log configuration in Enterprise Manager Fusion Middleware Control
– Isolated tests such as IdentityService calls or Java API’s
• It is important to know what is between your application and your authentication provider to structure
your debugging efforts and trace at which layer things go wrong
• WebLogic Console is relatively easy to debug compared to for example LibOVD. Application side
debugging is often also not very difficult.

WebLogic authentication debugging

WebLogic authentication debugging

More Related Content

What's hot

Viewers also liked

Similar to WebLogic authentication debugging

More from Maarten Smeets

Recently uploaded

WebLogic authentication debugging

Editor's Notes