midware life(tonyxu.net)

转自：http://weblogic-wonders.com/weblogic/2011/03/03/weblogic-connection-filters/

This post depicts a sample usage of Connection Filters in webLogic Server.

A connection filter allows the server to reject unwanted connections based on some filter criteria. For example, a connection filter would allow you to configure WebLogic to permit T3 or IIOP connections only from within your intranet, and reject any T3 or IIOP connection request from outside the intranet. So, connection filtering provides network-level access control.

WebLogic comes equipped with a default connection filter called  weblogic.security.net.ConnectionFilterImpl that examines one or more connection filter rules defined in the Administration Console. Alternatively, you can create your own custom connection filter that evaluates the basis that incoming connections are accepted by the server.

Please follow the steps to configure the Connection Filter.

1.  Login into to the console. Click on the Domain Name  –> Security –> Filter .

2. Define the ConnectionFilter class.

You can use the default class :  weblogic.security.net.ConnectionFilterImpl

3. Specify “Connection Filter Rules”.

You can specify any number of rules; each rule should be on a single line. The syntax for a connection filter rule is shown here:

target localAddress localPort action protocolList

Here are the definitions for the parameters of a connection filter rule:

• The target parameter specifies the client hosts that the rule must examine. We discuss its syntax later.
• The localAddress parameter refers to the server’s host address to which the client connects. If you specify an asterisk (*), this matches all local IP addresses.
• The localPort parameter indicates the server port to which the client connects. If you specify an asterisk (*), this matches all available ports.
• The action parameter indicates whether the rule should allow or reject the incoming connection request. It can take two possible values: allow or deny.
• Use the protocolList parameter to define a space-separated list of protocol names that should be matched. The protocol names can be: http, https, t3, t3s etc. If no protocols are listed, the rule checks for all protocols.

For Example:

www.abc.com 127.0.0.1 7001 deny t3 t3s http https

If you want to deny t3 t3s http https protocol access  from www.abc.com to the local server.

Note: Restart the servers.

4. Testing the connection.

Open a command prompt, set the environment by running the setDomainEnv script.

Try to connect to the server from the machine that is denied the access to.

You would see the below exception on the client side.

javax.naming.CommunicationException [Root exception is java.net.ConnectException: t3://localhost:7001: Destination unreachable; nested exception is:

java.io.IOException: Login failed: Failed: [Socket:000445]Connection rejected, filter blocked Socket, weblogic.security.net.FilterException: [Security:090220]rule 1; No available router to destination]

The Connection Filter is properly configured now.

An entry in the config.xml file would like below.

<connection-filter>weblogic.security.net.ConnectionFilterImpl</connection-filter>

<connection-filter-rule>localhost 127.0.0.1 7001 deny t3 t3s http https</connection-filter-rule>

For further reading:

http://download.oracle.com/docs/cd/E13222_01/wls/docs103/secmanage/domain.html#wp1174122

======================================================

本机上也做了下测试：

1、开启SSL端口

2、配置filter

3、修改完后，控制台报

根据提示，需要restart server

4、重启后，尝试用https://localhost:7002/console来访问控制台，报错，配置成功

config.xml里修改过的部分：

    <connection-filter>weblogic.security.net.ConnectionFilterImpl</connection-filter>
    <connection-filter-rule>localhost 127.0.0.1 7002 deny https</connection-filter-rule>

转自：http://weblogic-wonders.com/weblogic/2011/02/22/jmx-policy-editor-to-modify-deployer-role/

The below post describes how we can modify the default policy settings for the Deployer role users.

By default the user with Deployer role cannot start / stop the JDBC Data Source. There could be situations where you would like to provide the permissions to do so.

While trying to start/ stop a JDBC Data Source we might encounter the below errors.

Access not allowed for subject: principals=[deployer, Deployers], on Resource weblogic.management.runtime.JDBCDataSourceRuntimeMBean Operation: invoke , Target: isOperationAllowed

We can modify the default behavior by using the JMX Policy Editor to change the default JMX Policies.

Pre-requisites :

1. An User with Deployer role privileges.

Steps to modify the default JMX Policy Editor.

1.  Enable the feature to modify the JMX Policy Editor.

a . Log into the Administration, navigate to the current security realm.  MyRealm –> Configuration Tab.

b. Enable the “Use Authorization Providers to Protect JMX Access” option.

NOTE: Re-start the Admin Server so that the changes can be consumed.

2. Select the MBean operations whose permissions need to be modified.

a.  Login into the admin console, navigate to the Security Realms –> myrealm –>  Roles and Policies Tab.

b. Click on the Realm Policies sub tab, click on the JMX Policy Editor.

c. Global Scope is enabled by default , click Next.

d. From the list of Mbeans, expand weblogic.management.runtime type Mbeans.

e. Select the ‘JDBCDataSourceRuntimeMbean’  –>  Click Next.

f.  Select the “Operations: Permission to Invoke” which define which operations permissions can be modified.

Alternatively you can provide a more granular level control on the individual operations that needs to be controlled.

3. Edit the JMX security policies.

a.  Click on  CreatePolicy  –> Add conditions.

b.  From the predicate list, you can select an User or  Groups or Roles.

c. Click Save to complete the JMX Security Policy.

4. Testing the setup.

a. Login into the Admin Console with the deployer user and navigate to the DataSource.

b. Go to the Control subtab and now you can start/ stop the datasource.

NOTE: Similarly you can modify the access permissions of different Mbeans.

References:

http://download.oracle.com/
docs/cd/E13222_01/wls/docs100/ConsoleHelp/taskhelp/security/DefinePoliciesforMBeans.html