Tuesday, December 17, 2013

WebLogic "run as" webApplication

Here http://docs.oracle.com/cd/E11035_01/wls100/security/thin_client.html#wp1046373 you find an example on how to attach a principal to a webapp request, without having to explicitly passing it like in:

curl -u username:password url

it works like a breeze

weblogic.xml:

<?xml version = '1.0' encoding = 'windows-1252'?>
<weblogic-web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.bea.com/ns/weblogic/weblogic-web-app http://www.bea.com/ns/weblogic/weblogic-web-app/1.0/weblogic-web-app.xsd" xmlns="http://www.bea.com/ns/weblogic/weblogic-web-app">
  <context-root>gridlinkha</context-root>
    <run-as-role-assignment>
       <role-name>hypericrole</role-name>
       <run-as-principal-name>weblogic</run-as-principal-name>
     </run-as-role-assignment>  
</weblogic-web-app>




web.xml:


<?xml version = '1.0' encoding = 'windows-1252'?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5" xmlns="http://java.sun.com/xml/ns/javaee">
  <servlet>
    <servlet-name>FCFHAServlet</servlet-name>
    <servlet-class>oracle.support.ha.FCFHAServlet</servlet-class>
        <run-as>
      <role-name>hypericrole</role-name>
    </run-as>
  </servlet>
    <security-role>
    <role-name>hypericrole</role-name>
  </security-role>
  <servlet-mapping>
    <servlet-name>FCFHAServlet</servlet-name>
    <url-pattern>/fcfhaservlet</url-pattern>
  </servlet-mapping>
  <welcome-file-list>
    <welcome-file>/index.html</welcome-file>
  </welcome-file-list>
</web-app>




2 comments:

Jerry Zhiwei Cai said...

hi, do you need to create a "run-as-user" in the weblogic console myrealm?

Pierluigi Vernetto said...

the documentation linked in my post says:

Therefore, use the Administration Console to define the admin group, and define user joe and add joe to the admin group

honestly I don't remember...can you please try and let us know?