WSRP Security: Security WSRP Messages over wire in Weblogic Portal

Usecases:

1. Provide Security for WSRP portlets so that only authenticated Consumers can access the exposed portlets
2. Provide transport layer security for WSRP messages so that SOAP Messages between WSRP Producer and WSRP consumer are encrypted

For #1, The user identity can be acheived in two ways in Weblogic Portal 10.3.2

• SAML Tokens (default) link
• User Name Tokens link

For #2, Open up, WEB-INF/wsrp-producer-config.xml inside Producer’s application and change secure attribute to true. After changes, it should look like below:

<markup secure="true" rewrite-urls="true" transport="string" accepts-mime="false"
return-markup-during-interaction="true"
isolate-session-cookies-for-local-consumer="false"/>

A packet sniffing tool like TCPMonitor can be used to verify this configuration.

keywords: Weblogic Portal 10.3.2 (11g), WSRP Producer, WSRP Consumer

Weblogic Proxy Servlet Configuration: weblogic.servlet.proxy.HttpProxyServlet

When you use WebLogic Server as your primary Web server, you may also want to configure WebLogic Server to pass on, or proxy, certain requests to a secondary Web server, such as Apache, or Microsoft Internet Information Server. Any request that gets proxied is redirected to a specific URL.You can even proxy to another Web server on a different machine.You proxy requests based on the URL of the incoming request.

The HttpProxyServlet (provided as part of the distribution) takes an HTTP request, redirects it to the proxy URL, and sends the response to the client’s browser back through WebLogic Server. To use the HttpProxyServlet, you must configure it in a Web Application and deploy that Web Application on the WebLogic Server that is redirecting requests.

web.xml

<servlet-name>ProxyServlet</servlet-name>
<servlet-class>weblogic.servlet.proxy.HttpProxyServlet</servlet-class>
<init-param>
<param-name>redirectURL</param-name>
<param-value>http://localhost:8080</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>ProxyServlet</servlet-name>
<url-pattern>/MyProducerApp/*</url-pattern>
</servlet-mapping>

http://forums.oracle.com/forums/thread.jspa?threadID=768101&tstart=1343