Middleware
WebLogic Server
How-To Configure and Use Oracle JDBC Driver SSL with Oracle WebLogic Server
April 2009
Pas Apicella and Frances Zhao
- Introduction
- What you should know?
- How to Configure and Use Oracle JDBC Driver SSL with Oracle WebLogic Server
Introduction
Secure Sockets Layer (SSL) is an industry standard protocol for securing network connections. SSL uses RSA public key cryptography in conjunction with symmetric key cryptography to provide authentication, encryption, and data integrity.
By using Oracle Advanced Security SSL functionality to secure communications between JDBC Thin clients and servers, you can:
- Encrypt the connection between clients and servers.
- Authenticate the network client tier: the Database server only accepts connections from clients, such as Oracle Application Server, which have a certificate signed by a trusted authority. Any connection attempt from a client tier or an application that the Database doesn’t trust will fail.
- Authenticate the Database tier: the JDBC Thin driver can be configured to validate the Database’s certificate. If it hasn’t been signed by a trusted authority, the connection will fail. From the application standpoint, you have proof that the Database can be trusted.
- Use SSL as an Authenticate Service on the server (starting in 11.1.0.6 for the JDBC Thin driver): the Database user, as opposed to the network client tier, is authenticated through SSL. In this case each Database user has his certificate.
The following how to is an example of JDBC/THIN SSL setup using the 11.1.0.6 JDBC driver against an 11.1.0.6 Oracle Database Server. It demonstrates, creates a self signed oracle wallet for the server and client and then using this to create a data source with Oracle WebLogic 10.3. In this example, we used OraclePKI to create our keys to generate certificates.
What you should know?
- You should be familiar with these products: Oracle Database JDBC Driver, Oracle WebLogic Server
How to Configure and Use Oracle JDBC Driver SSL with Oracle WebLogic Server
Create the wallets
For an example on how to create the server.client keys/certificates see the following metalink note.
Article-ID: Note 762286.1
Title: End To End Examples of using SSL With Oracle's JDBC THIN Driver
Setup WebLogic to use JDBC/THIN with SSL
1. Firstly copy over rthe required oracle JAR files for SSL. Those jar files are shown below. In this exmaple we place them in our domain directory within a sub directory called " oraclelibs"
|
[oracle@@papicell-au2 /u01/bea103/user_projects/domains/jdbcssl/oraclelibs]$ d
|
2. Add the JAR files into the domains classpath. Edit the file setDomainEnv.sh
|
# SET THE CLASSPATH
|
Note: We don't add ojdbc6.jar as that comes with Oracle Weblogic 10.3 out of the box.
3. Copy the client/server wallets over to the domain home, in this demo we only require the client wallets
|
[oracle@@papicell-au2 /u01/bea103/user_projects/domains/jdbcssl/wallets]$ ls -lRt
|
4. Create a WebLogic Startup class as follows
|
package pas.au.wls;
|
5. Create a JAR file which we will add to the classpath , you can use the zip below which contains a JAR file which can be used here. This JAR file contains the class above which will work on any WebLogic server which requires the use of OraclePKI.
wls103startup.zip
6. Add the JAR file extracted from the ZIP below into your domains classpath by edting
setDomainEnv.sh
|
# SET THE CLASSPATH
|
7. Log into console as follows
http://<server>:<port>/console
8. Navigate within the "Domain Structure" window on the left hand side to "Environment" -> "Startup & Shutdown Classes"
9. Click the New button
10. Ensure that the radio option "Startup Class" is selected and click next
11. Specify the following Startup Class Properties
Name - Oracle JDBC Startup Class
Class Name - pas.au.wls.JDBCStartupClass
12. Click Next
13. Target this to the your managed server and also the "AdminServer". In our case our managed server is called "apple" as shown below. We target this to the AdminServer as the JDBC resoures are created when we start WebLogic which requires us to have enabled Oracle PKI provider which the startup class will do for us.
14. Click Next
15. Click Finish
16. Edit your new Startup class
17. Select the checkbox "
Run Before Application Deployments" to ensure this startup class runs before any services are created. This will ensure
the connection pool will be able to create without a runtime error at container startup.
18. Press the "Save" button
At this point you should stop WebLogic and start it up agian as shown. As you can see our startup class successfully runs as it will do for the AdminServer and our managed server "apple". You should see the message as follows "
JDBCSSLSetup startup class: OraclePKIProvider has been successfully instantiated" when either the AdminServer starts up or our managed server "apple"
|
[oracle@@papicell-au2 /u01/bea103/user_projects/domains/jdbcssl/bin]$ ./startWebLogic.sh
|
1. Log into console as follows
http://<server>:<port>/console
2. Navigate to "Services" -> "JDBC" -> "Data Sources"
3. Click new
4. Enter in details as shown below.
5. Click next
6. Click next
7. Enter in database connection details, and click next
8. At this point we want to make sure we connect using TCPS which we do as follows by altering the URL as shown below.
|
jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=beast.au.oracle.com)
|
9. Enter in the following JDBC driver properties, along with the property for the current user
|
user=scott
|
10. Click Next
11. Target this to your managed server in this case "apple".
12. Click Finish
13. Click on the data source "
jdbc/scottSSLDS"
14. Click on the tab "Connection Pool"
15. Scroll down to the bottom of the page and click the "Advance" link to expand it.
16. Check the option "Test Connections On Reserve".
17. Press the Save button
18. Click on the "Monitoring"" tab
19. Click on the "Testing" tab
20. Select the server the data source is targeted for, in our case "apple"
21. Press the "Test Data Source" button
Verify you have succesfully setup the data source to use JDBC/THIN with SSL
Printer View