Meaningless Drivel is fun!*
The moose likes BEA/Weblogic and the fly likes access control on jndi lookup Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Products » BEA/Weblogic
Bookmark "access control on jndi lookup" Watch "access control on jndi lookup" New topic
Author

access control on jndi lookup

Abhinav Srivastava
Ranch Hand

Joined: Nov 19, 2002
Posts: 349

while accessing EJBs or DataSources using InitialContext and JNDI Names, we have the option of supplying Context.SECURITY_PRINCIPAL and Context.SECURITY_CREDENTIALS

I am able to access when I don't provide any principal or credential, or when I provide the right values but not when i provide wrong values. How do I disable access when no values are provided.
Roger Chung-Wee
Ranch Hand

Joined: Sep 29, 2002
Posts: 1683
The default values for Context.SECURITY_PRINCIPAL and Context.SECURITY_CREDENTIALS depend on whether the current thread is already associated with a user defined in the WebLogic security realm. If they are, then the values default to the current user. If not, these properties default to guest user.

You can set these properties in a jndi.properties file which has been placed where the application classloader can find it. Once the properties have been set, you can simply instanciate InitialContext by using the no-arg constructor.


SCJP 1.4, SCWCD 1.3, SCBCD 1.3
Abhinav Srivastava
Ranch Hand

Joined: Nov 19, 2002
Posts: 349

where does the "guest" user come from? what do i have to do in order to disable this user? its like having all the security and still being able to access the server without passing any credentials!
Roger Chung-Wee
Ranch Hand

Joined: Sep 29, 2002
Posts: 1683
The guest user may not be enabled by default - this depends on the version of WebLogic Server which you are running. In any case, you should never default to guest user if your user is defined in the WebLogic security realm.

To disable the guest user, do the following.

Go to the Change Center of the Administration Console, click Lock & Edit. Select your domain and select Compatibility Security > General. Now select the Guest Disable checkbox. You will need to reboot your server for this change to take effect.
 
 
subject: access control on jndi lookup
 
Similar Threads
Mysql and WSAD 5.1
JNDI setup
JNDI server persistance
Accessing my jndiContext.lookup from Dos
JNDI basics