Use WSLT to set OSB 11g security authorization policy rules

We want to set the proxy service security authorization policy rules using WSLT. This is a biggy. Since it is undocumented feature and not supported by Oracle. I relied on a single post here http://ohnoes-nz.blogspot.com/2012/03/oracle-service-bus-using-wlst-to-secure.html, and I had to do some reverse engineering of Java classes in the OSB jars to sort out the API.

As an occasional user of WLST, I banged my head for a couple of days to make it work with OSB 11.1.1.6. Below is the working version of the script. I left in the comment more calls that can query and set the rules at different levels, feel freel to experiment:

import wlstModule
from com.bea.wli.sb.management.configuration import SessionManagementMBean
from com.bea.wli.sb.management.configuration import ALSBConfigurationMBean
from com.bea.wli.sb.security.management.configuration import ServiceSecurityConfigurationMBean
from com.bea.wli.config import Ref
from com.bea.wli.sb.util import Refs
from java.lang.reflect import Proxy
try:
#############
# execute sentDomainEnv.cmd, then add sb-kernel-impl.jar;com.bea.alsb.security.api.jar to classpath
# to run the script: %wl_home%\common\bin\wlst.cmd (this script file).py
############

# by default, after connect, pwd() shows 'serverConfig:/'
connect("weblogic", "welcome1", "t3://localhost:7001")
########
### locate session bean, then create a new session
#########
domainRuntime() # land in 'domainRuntime:/'
# need domainRuntime(), obtain session management mbean to create a session.
sessionMBean = findService(SessionManagementMBean.NAME,   SessionManagementMBean.TYPE)
print "***SessionMBean is: ", sessionMBean
# create a session
sessionName = String("SecurePaymentService"+Long(System.currentTimeMillis()).toString())
sessionMBean.createSession(sessionName)
print "###session created: ", sessionMBean
########
### create proxy ref
#########
projectName = Refs.makeParentRef("OWSM Demo" + '/')
proxyRef = Refs.makeProxyRef(projectName, "helloBye")
print "***proxyRef: ", proxyRef
proxyReference = proxyRef
########
### find OSB security config bean
#########
serverConfig() # cd('serverConfig:/')
security_mbean_ih = MBeanServerInvocationHandler(mbs, ObjectName("com.bea:Name=%s.%s,Type=%s" % (ServiceSecurityConfigurationMBean.NAME,sessionName, ServiceSecurityConfigurationMBean.TYPE)))
serviceSecurityConfigurationMBean = Proxy.newProxyInstance(ServiceSecurityConfigurationMBean.getClassLoader(),jarray.array([ServiceSecurityConfigurationMBean],java.lang.Class),security_mbean_ih)
print "\r\n###serviceSecurityConfigurationMBean: ", serviceSecurityConfigurationMBean
########
### set up policy holder, and policy scope
#########
policyHolder = serviceSecurityConfigurationMBean.newAccessControlPolicyHolderInstance('XACMLAuthorizer')
print "\r\n=========policyHolder: ", policyHolder

policyStr="Rol(helloRole)"
operation="sayHello"
policyHolder.setPolicyExpression(policyStr)
print "\r\n###policyHolder: ", policyHolder

policyScope = serviceSecurityConfigurationMBean.newOperationMessagePolicyScope(proxyReference, operation)
#policyScope = serviceSecurityConfigurationMBean.newDefaultMessagePolicyScope(proxyReference)
#policyScope = serviceSecurityConfigurationMBean.newProxyPolicyScope(proxyReference)
print "\r\n************************policyScope: ", policyScope

########
### excute security config commands
#########
serviceSecurityConfigurationMBean.setAccessControlPolicy(policyScope, policyHolder)
#serviceSecurityConfigurationMBean.removeAccessControlPolicy(policyScope, policyHolder.getAuthorizationProviderID())

 #px = serviceSecurityConfigurationMBean.getAccessControlPolicy(policyScope, policyHolder.getAuthorizationProviderID())
 #print "###px: ", px
sessionMBean.activateSession(sessionName, "description for session activation")
print "script returns SUCCESS"
except:
    print "Unexpected error: ", sys.exc_info()[0]
    dumpStack()
    raise

The screen shot shows the result the of the execution:

osb/config/sessions directory

I'm working on something that i need to use WSLT to navigate the configuration MBeans on OSB.

Here is what I was doing:

connect("weblogic", "welcome1", "t3://localhost:7001")

custom()

cd('/bea.com')

ls()

Then i see a ton of stuff roll past the screen. They all looked like the sessions that I created while running my test script. They cluttered my screen so I can't see what i was looking for. 

I thought all of these stuff must come from some temp files under the "servers" directly like "AdminServer", "osb_server1" etc, so i blew those directories and restarted the suite, lo and behold, those sessions still show up in the wslt console.

I finally stumbled upon this directory "C:\Oracle\Middleware\user_projects\domains\soa_domain\osb\config\sessions", that's where all the garbage sessions are stored. I just blew them away. Now when i run ls() command, i can find what i was looking for.

Incidentally, i also found out the directories under "sessions" correspond to the OSB session history list when you click on "View Changes" on the top left of sbconsole. If something is changed and saved, but not committed yet, the saved changes are kept in the corresponding session directory.

A few WLST trivia:

1. by default, after you connect("weblogic", "welcome1", "t3://localhost:7001"), your pwd() shows 'serverConfig:/'

2. similarly:
  domainRuntime() - goes to 'domainRuntime:/', it is equivalent to running cd('domainRuntime:/')
  serverRuntime() - goes to 'serverRuntime:/', it is equivalent to running cd('serverRuntime:/')
  serverConfig() - goes to 'serverConfig:/', it is equivalent to running cd('serverConfig:/')

  custom() - goes to 'custom:/', it is equivalent to running cd('custom:/')

WLST and MDS

Developers commonly use JDeveloper to create deployment project to upload files to MDS.

To remove files from MDS, you need to use WLST tool. In fact, you can use WLST tools to import, export, delete, purge and remove MDS directories.

The following are the commonly used WLST “commands” to manipulate the MDS:

·        importMetaData – import directories and documents

·        exportMetaData – export MDS trees and documents

·        deleteMetaData – delete MDS documents (not directories)

·        purgeMetaData

·        sca_removeSharedData – remove directories and documents

These “commands” appear to be straight forward, but you can easily be tripped over if you don’t pay attention to some details.

Not All wlst.cmd Files Are Created Equal

Depends on how WLST is started, and where it’s started, you may have different “commands” available to you. Which WLST “commands” are available to you, depends on what .jar files you load into the classpath when you start WLST tool.

With my locally installed SOA suite, I found 6 different versions of “wlst.cmd”:

1.      C:\Oracle\Middleware\wlserver_10.3\common\bin

2.      C:\Oracle\jdev-mw\wlserver_10.3\common\bin

3.      C:\Oracle\jdev-mw\oracle_common\common\bin

4.      C:\Oracle\Middleware\Oracle_OSB1\common\bin

5.      C:\Oracle\Middleware\oracle_common\common\bin

6.      C:\Oracle\Middleware\Oracle_SOA1\common\bin

Not all wslt.cmd files in this list support MDS commands. I know #2 doesn’t work.

I was able to import and export MDS data using wslt.cmd under #3, C:\Oracle\jdev-mw\oracle_common\common\bin. But I have to use #6 (C:\Oracle\Middleware\Oracle_SOA1\common\bin) for sca_removeSharedData command to work.

Examples Using WSLT to Work with MDS

cd c:\Oracle\jdev-mw\oracle_common\common\bin

connect(‘weblogic’, ‘welcome1’, 't3://localhost:7001')

To export data

exportMetadata(application='soa-infra', server='soa_server1', toLocation='c:/junk/mdsout', docs='/apps/test/**')

Assuming I have some files in MDS under “/apps/test” tree, this command will create the “c:\junk\mdsout\apps\test” directory, this directory will contains all non-empty directories and files in  MDS under ‘/apps/test’ tree.

Notes:

1.      You may need to do: exportMetadata(application='soa-infra', server='soa_server1', toLocation='c:/junk/mdsout', docs='/apps/test/**', remote=’true’) if your server is remote (not localhost).
2.      You may need to do: exportMetadata(application='soa-infra', server='soa_server1', toLocation='c:/junk/mdsout/test.jar', docs='/apps/test/**') if your server is remote (not localhost) depends on which version of wlst.cmd you use.
3.      This commands only dumps out non-empty tree structures in MDS

To import data

importMetadata(application='soa-infra',server='soa_server1',fromLocation='C:/junk/mdsout', docs='/apps/test/**')

This will import data files under c:\mdsout\apps\test into MDS tree “apps/test”.
This command will not import empty directories. Like export command, you may need to import .jar file instead of directories.

To Delete Data

deleteMetadata(application='soa-infra',server='soa_server1',docs='/apps/test/**')
This will only delete all files under MDS /apps/test tree, it will not delete the directories.

To Remove the Directories

sca_removeSharedData('http://localhost:8001', ‘test’) - will remove MDS tree “/apps/test”
sca_removeSharedData('http://localhost:8001', 'test/dvm')  - will remove MDS tree “/apps/test/dvm”

Be careful, do not add / in ‘test’ or ‘test/dvm’, otherwise WLST complains cannot find documents to remove.