Configuring Certificate Based Authentication in WebLogic 10.3.3

In my previous post, I had discussed the steps needed to configure 2-way SSL in WebLogic. As a step further, in this article I will discus the steps needed to create an environment for Certificate based authentication.

Following are my assumptions -

• Weblogic Server has been setup for 2-way SSL for a principal with the name robert.brown
• Client certificate/key for robert.brown has been imported into the browser's Personal identity store
• User robert.brown has been created in the Weblogic Server and assigned to group AuthorizedGroup
• AuthorizedRole is mapped to AuthorizedGroup
• Web application (war) with CLIENT-CERT based authentication method is deployed in the Weblogic Server. The application allows access to all users in the AuthorizedRole role. This configuration is setup in the web.xml of the web application.

Now, to set this application for authentication, perform the following steps in the Weblogic Server

Logon to Weblogic Admin Console

Click Security Realm

Click myrealm

Click Providers

Click New button

Select DefaultIdentityAsserter

Enter an appropriate name

Click the newly created IdentityAsserter

Add X.509 to Chosen

Click ProviderSpecific tab

Select CN in Default User Name Mapper Attribute Type. It is assumed that the user name is available in the subject name in the certificate

Check Use Default User Name Mapper

Click Save

Restart Server

To test, enter the URL of the web application. If the browser has multiple keys personal keys installed, it should ask which key is to be used for SSL and after choosing a key, automatically the user should be logged in as robert.brown in the web application.