WebLogic 8.1 two-way SSL authentication on a web app full example?

Question

Does anybody has a WebLogic 8.1 two-way SSL full example?

I am developing a small web application (1 HTML, 1 Servlet, 1 JSP) to send confidential data. The client could be a web browser. The server is WebLogic 8.1.

The information should travel encrypted. Besides, the web application needs to authenticate the client, using more than a username/password combination. I thought implementing using HTTPS and two-way SSL authentication. This way, the user should send me her certificate, I installed in the server, so the web application could know when it is sending information.

Now, I know how to use declarative authorization in a web application, but I am lost on how specify which users I recognize, and which are their certificates.

I just need a full example of this. A .war and/or the steps to do the basic case.

Answer 1

I don't think you'll find a full example easily and the question is a bit broad. But the link your provided is a very good starting point.

First configure Two-Way SSL and use CLIENT-CERT. Clients will need to buy a trusted client certificate or to generate a self-signed certificate that you'll need to add to the server trust store. This may be the hardest part if you're not familiar with PKI but I've added resources at the end of this answer that cover this part. Load the client certificate in each client browsers.

Second, configure an Identity Assertion provider to map the digital certificate of a Web browser to a user in a WebLogic Server security realm. If required, provide your own user name mapper or use the default one (which uses the attributes from the subject DN of the digital certificate or the distinguished name to map to the appropriate user in the WebLogic Server security realm).

Third, add users corresponding to the Subject's Distinguished Name (SubjectDN) attribute in the client's digital certificate in Weblogic Security Realm and assign them to groups.

Finally, use these groups in your declarative authorizations.

Sure, it won't be that easy if everything is new but that's basically what you need to do. Maybe start to implement it and open more specific questions if you need more guidance.

---

More resources:

• Two-Way SSL in Weblogic for Developers
• The Fifteen Minute Guide to Mutual Authentication
• Certificate to User Mapping in WebLogic
• How to Set Up X509 Certificate Authentication for Oracle WebLogic Server (transposable to WLS 8.1)