将LDAP用户与Weblogic服务器本地组相关联

Question

I have created one group on web-logic server, now i want to add user in that groups(they are configured on LDAP Server).

how can I achieve the same. or is there any way I can get all list of LDAP users or groups through some java code.

Answer 1

You're actually making life harder for yourself than it needs to be here.

A user's group memberships should be defined in the same security realm as the user themselves - you can't get part of the subject from one place and part of it from the other, at least not without creating a custom security provider as far as I'm aware, and that's way more effort than its worth.

If the users are defined in an external LDAP server, this is where the group membership should also be configured.

A possible alternative depending on what you're securing would be to use role-based security configuration, but even then you still want something to determine membership in a role, and that should typically be a group.

Security configuration should always be based on groups rather than users, otherwise maintenance will become very painful.