{"id":7771,"date":"2020-10-28T15:51:08","date_gmt":"2020-10-28T15:51:08","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/secure-active-directory-authentication-for-weblogic-server\/"},"modified":"2026-11-03T19:29:02","modified_gmt":"2026-11-03T19:29:02","slug":"secure-active-directory-authentication-for-weblogic-server","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/secure-active-directory-authentication-for-weblogic-server\/","title":{"rendered":"Secure Active Directory authentication for Weblogic Server"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>This post explains how to secure Microsoft\u00ae Active Directory\u00ae (AD) authentication&nbsp;by using Secure Sockets Layer (SSL).<\/p>\n<p>As we all know, security on every layer is important. SSL implementation usually occurs on&nbsp;the application layer, web layer, and network layer. This post describes how to enable&nbsp;secure authentication on the provider layer. An authentication provider allows Oracle\u00ae WebLogic Server&amp;reg; to establish trust by validating a user.&nbsp;<\/p>\n<p><strong>Lightweight Directory Access Protocol (LDAP)<\/strong><\/p>\n<p>LDAP is an open client-server protocol used with various directory services that store&nbsp;credentials. Commonly, LDAP serves as a central place for authentication, meaning it stores&nbsp;usernames and passwords.<\/p>\n<ul>\n<li><strong>Active Directory (AD)<\/strong>: A directory server is like a database, but tends to contain&nbsp;more descriptive, attribute-based information. Generally, systems read the information&nbsp;&nbsp; in a directory much more often than they write to it.<\/li>\n<li><strong>Secure Sockets Layer<\/strong>: More commonly known as SSL, this is a cryptographic protocol.&nbsp;&nbsp; Nowadays, security is a major concern for every organization. SSL is essential for&nbsp;&nbsp; protecting websites and user authentication over both the Internet and intranet.<\/li>\n<\/ul>\n<p><strong>How AD authentication works in WebLogic<\/strong><\/p>\n<p>As soon as a client logs into an application deployed on the WebLogic server, AD&nbsp;authenticates the credentials through myRealm based on the configuration.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26493-body-Picture1_25.png\" alt=\"weblogic pic 1\" \/><\/p>\n<p><a href=\"https:\/\/subscription.packtpub.com\/book\/networking_and_servers\/9781849686969\/8\/ch08lvl1sec62\/using-an-external-ldap-server\"><em>Image Source<\/em><\/a>&nbsp;<\/p>\n<p>LDAP is the bridge that connects WebLogic with AD.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26493-body-Picture2_16.png\" alt=\"weblogic pic 2\" \/><\/p>\n<p>\nFollowing are some of the many reasons for adding SSL to any environment:&nbsp;<\/p>\n<ul>\n<li>To ensure secure communications, LDAP transactions must be encrypted using an SSL\/TLS connection.&nbsp;<\/li>\n<li>To secure unauthenticated user logins from the outside world.<\/li>\n<li>To exchange data in an encrypted format instead of clear text.<\/li>\n<li>To authenticate data transfer between servers, systems, applications, and users.<\/li>\n<li>To provide higher security and better management of important data.&nbsp;<\/li>\n<\/ul>\n<p><strong>Prerequisites&nbsp;<\/strong><\/p>\n<ol>\n<li>Install WebLogic and run it with non-secure AD connections.<\/li>\n<li>Be prepared to use<em> `keytool`<\/em>. The `keytool` command is a key and certificate management utility found in JAVA\\_HOME: <strong>JAVA\\_HOME\/jre\/bin\/keytool<\/strong>.<\/li>\n<li>Install OpenSSL. OpenSSL is a software library for applications that secures communications over computer networks against eavesdropping or the need to identify the party at the other end. Find OpenSSL in <strong>\/usr\/bin\/openssl<\/strong>.<\/li>\n<\/ol>\n<p><strong>Step 1: Generate KeyStore and CSR<\/strong><\/p>\n<p>A CSR is a block of encoded text containing the public key included in the certificate.&nbsp;The private key and CSR are usually created at the same time, making them a key pair. You&nbsp;use the public key to encrypt and the corresponding private key to decrypt.<\/p>\n<p>A KeyStore is the repository where you store private keys and certificates.<\/p>\n<p>Use the following steps to generate the KeyStore and CSR<strong>:<\/strong><\/p>\n<p><strong>1A: Generate the KeyStore<\/strong><br \/>\nRun the following commnd to generate the KeyStore:<\/p>\n<p><em>&nbsp;[user@host cert]$ keytool -genkey -alias AliasName -keyalg RSA -keysize 2048 -keypass ***** -keystore your_domain.jks -storepass *****&nbsp;<\/em><\/p>\n<p><em>&nbsp;What is your first and last name?<br \/>\n&nbsp; &nbsp; &lt;provide Server Name for which authentication is required&gt;<br \/>\n&nbsp; &nbsp; What is the name of your organizational unit?<br \/>\n&nbsp; &nbsp; &lt;provide Organization Short name&gt;<br \/>\n&nbsp; &nbsp; What is the name of your organization?<br \/>\n&nbsp; &nbsp; &lt;provide Organization full name&gt;<br \/>\n&nbsp; &nbsp; What is the name of your City or Locality?<br \/>\n&nbsp; &nbsp; &lt;provide City&gt;<br \/>\n&nbsp; &nbsp; What is the name of your State or Province?<br \/>\n&nbsp; &nbsp; &lt;provide State&gt;<br \/>\n&nbsp; &nbsp; What is the two-letter country code for this unit?<br \/>\n&nbsp; &nbsp; &lt;provide Country Code&gt;<\/em><\/p>\n<p>After the command finishes, it generates a file with <strong>your_domain.jks<\/strong><\/p>\n<p><strong>&nbsp;Parameters<\/strong><\/p>\n<ul>\n<li><strong>genkey<\/strong>: The command to generate the key.<\/li>\n<li><strong>alias<\/strong>: `IT` indicates the alias to be used in the future to refer to the KeyStore entry.<\/li>\n<li><strong>keyalg<\/strong>: The algorithm used to generate the key.&nbsp;<\/li>\n<li><strong>keysize<\/strong>: The size in bits of the generated keys.&nbsp;<\/li>\n<li><strong>keypass<\/strong>: &nbsp;Specifies a password for the private key.<\/li>\n<li><strong>keystore<\/strong>: The name of the KeyStore file in which to store the generated key pair. The command creates the file if it does not exist.<\/li>\n<li><strong>storepass<\/strong>: Specifies the `keystore` password..&nbsp;<\/li>\n<\/ul>\n<p><strong>&nbsp;1B: Generate the CSR&nbsp;<\/strong><\/p>\n<p>A certificate signing request (CSR) is your own SSL Certificate. Generate on the same server&nbsp;where you plan to install the certificate. &nbsp;Use the following command to generate the&nbsp;certificate request in a file named <strong>your_domain.csr<\/strong><\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ keytool -certreq -v -alias AliasName -keyalg RSA -sigalg SHA256withRSA -file your_domain.csr -keypass **** &nbsp;-storepass **** -keystore your_domain.jks.<\/em><\/p>\n<p>The KeyStore and CSR are ready now for further processing.<\/p>\n<p><strong>&nbsp;Parameters<\/strong><\/p>\n<ul>\n<li><strong>certreq<\/strong>: The command to request a certificate.<\/li>\n<li><strong>sigalg<\/strong>: The `SHA256withRSA` signature is an efficient asymmetric encryption method used in many secure APIs.<\/li>\n<li><strong>file<\/strong>: The file&#8217;s name to read from or write to (for a certificate or certificate request).<\/li>\n<\/ul>\n<p><strong>1C: Request to Certificate authorities for &nbsp;the Server\/root\/intermediate certificate.&nbsp;<\/strong><\/p>\n<p>A Certification Authority (CA) &nbsp;issues digital certificates. The CA acts as a trusted&nbsp;third party&#8211;trusted both by the subject (owner) of the certificate and by the party&nbsp;relying upon the certificate.You need to share servers public key when sharing CSR so authorities can generate public&nbsp;certificates.<\/p>\n<ul>\n<li><strong>Root Certificate<\/strong>: A root certificate is a digital certificate that belongs to the&nbsp;&nbsp; issuing CA, which closely guards the root certificate.<\/li>\n<li><strong>Intermediate Certificate<\/strong>: Intermediate certificates act as middlemen between the&nbsp;protected root certificates and the server certificates issued out to the public.&nbsp;<\/li>\n<li><strong>Server Certificate<\/strong>: The server certificate is the one issued to a specific domain.<\/li>\n<\/ul>\n<p><strong>&nbsp;Step 2: Receive the certificate from the Authority and import it to the KeyStore<\/strong><\/p>\n<p>Mostly, the Authority sends the certificate chain in the <strong>P7B<\/strong>&nbsp;file, which contains&nbsp;certificates and chain certificates (Intermediate CAs). The system stores the <strong>PKCS#7&nbsp;<\/strong>or <strong>P7B<\/strong> format in Base64 ASCII format with a file extension, <strong>p7b<\/strong>, such as the<br \/>\nfollowing example:<\/p>\n<p>&nbsp; &nbsp; &#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; MIIO8wYJjJpySj9EBbiP4p+AkWldrvTe5gGlY+JNbVPbRCPDDDZd+0n+BTEA<br \/>\n&nbsp; &nbsp; &#8212;&#8211;END CERTIFICATE&#8212;-<\/p>\n<p><strong>2A: Convert the file format<\/strong><\/p>\n<p>Convert <strong>p7b<\/strong>&nbsp;to <strong>cer<\/strong>&nbsp;format by using the following command and separate the server,&nbsp;intermediate, and root certificates from &nbsp;<strong>your_domain.cer<\/strong>:<\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ openssl pkcs7 -print_certs -in your_domain.p7b -out your_domain.cer<\/em><\/p>\n<p>Now see the contents of <strong>your_domain.cer<\/strong>. It has three sections (Server\/Intermediate\/Root):<\/p>\n<p>&nbsp; &nbsp; subject=\/C=**\/ST=**\/L=**\/O=***\/OU=**\/CN=hostname<br \/>\n&nbsp; &nbsp; issuer=\/DC=**\/DC=**\/CN=**-SUB-CA<br \/>\n&nbsp; &nbsp; &#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; &#8212;&#8211;END CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; subject=\/DC=**\/DC=**\/CN=***-SUB-CA<br \/>\n&nbsp; &nbsp; issuer=\/DC=**\/DC=***CN=**-ROOT-CA<br \/>\n&nbsp; &nbsp; &#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; &#8212;&#8211;END CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; subject=\/DC=***\/DC=**\/CN=***-ROOT-CA<br \/>\n&nbsp; &nbsp; issuer=\/DC=**\/DC=**\/CN=**-ROOT-CA<br \/>\n&nbsp; &nbsp; &#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<br \/>\n&nbsp; &nbsp; &#8212;&#8211;END CERTIFICATE&#8212;&#8211;<\/p>\n<p><strong>2B: Import certificates<\/strong><\/p>\n<p>Use the following commands to import the certificates in order to the KeyStore,&nbsp;<strong>AliasName_server\/AliasName_intermediate\/AliasName_Root<\/strong>:<\/p>\n<p>&nbsp;<em> &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias AliasName_Root &nbsp;-file root.cer -keystore your_domain.jks -storepass *****<\/em><\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias AliasName_intermediate -file intermediate.cer -keystore your_domain.jks -storepass ****<\/em><\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias Alias_Name -file your_domain.cer -keystore your_domain.jks -storepass ******<\/em><\/p>\n<p><strong>2C: Validate the KeyStore<\/strong><\/p>\n<p>Use the following command to validate the KeyStore:<\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ java utils.ValidateCertChain -jks Alias_Name our_domain.jks<br \/>\n&nbsp; &nbsp; &nbsp;Cert[0]: CN=servercert,OU=***,O=****,L=****,ST=****,C=**<br \/>\n&nbsp; &nbsp; &nbsp;Cert[1]: CN=Intermediate_CNAME,dc=***,dc=****<br \/>\n&nbsp; &nbsp; &nbsp;Cert[2]: CN=Root_CNAME,dc=***,dc=***<br \/>\n&nbsp; &nbsp; &nbsp;Certificate chain appears valid<\/em><\/p>\n<p><strong>Step 3: Create OVD KeyStore and import CA certs<\/strong><\/p>\n<p>To secure connection to external systems, you need an OVD KeyStore. If you are configuring&nbsp;authenticators and have configured an additional LDAP Authenticator to communicate over SSL,&nbsp;put the corresponding LDAP server&#8217;s root certificate in a different KeyStore used by the&nbsp;Identity Virtualization Library (libOVD) functionality.<\/p>\n<p>The libOVD adapter enables the Oracle Virtual Directory to present LDAP versions and AD&nbsp;data as a subtree of the virtual directory by providing automatic real-time directory&nbsp;structure and schema translation.<\/p>\n<p><strong>3A: Set environment variables<\/strong><\/p>\n<p>1. Set MIDDLEWARE\\_HOME to the appropriate Middleware home directory.<br \/>\n2. Set ORACLE\\_HOME to <strong>$MIDDLEWARE\\_HOME\/oracle\\_common<\/strong>.<br \/>\n3. Set WL\\_HOME to <strong>$MIDDLEWARE\\_HOME\/wlserver_10.3<\/strong>.<br \/>\n4. Set JAVA\\_HOME to appropriate jdk path <strong>..\/jdk<\/strong>.<\/p>\n<p>Change directory to <strong>$ORACLE_HOME\/bin\/<\/strong><\/p>\n<p><strong>3B: Run the libOVD command&nbsp;<\/strong><\/p>\n<p>To create libOVD configuration files and layout the directory structure, run the following&nbsp;command:<\/p>\n<p><em>&nbsp; &nbsp; [user@host cert]$ .\/libovdconfig.sh -host HOSTNAME -port AdminServerPort -userName Adminloginusername -domainPath DOMAIN_HOME -createKeystore<\/em><\/p>\n<p>&nbsp; &nbsp; Enter AdminServer password: &lt;provide the password of Weblogic console login&gt;<br \/>\n&nbsp; &nbsp; Enter OVD Keystore password: &lt;provide the password of Weblogic console login&gt;<br \/>\n&nbsp; &nbsp; OVD config files already exist for context: &lt;default&gt;<br \/>\n&nbsp; &nbsp; CSF credential already available for context: &lt;default&gt;<br \/>\n&nbsp; &nbsp; Permission grant already available for context: &lt;default&gt;<br \/>\n&nbsp; &nbsp; OVD MBeans already configured for context: &lt;default&gt;<br \/>\n&nbsp; &nbsp; Successfully created OVD keystore.<\/p>\n<p>The preceding command creates the KeyStore directory inside <strong>$DOMAIN_HOME\/config\/fmwconfig\/ovd\/default<\/strong><\/p>\n<p><strong>3C: Import the root certificate<\/strong>.<\/p>\n<p>Run the following commands to import the <strong>root\/intermediate\/server<\/strong>&nbsp;certificates, which&nbsp;you initially fetched to <strong>$DOMAIN_HOME\/config\/fmwconfig\/ovd\/default\/keystores\/adapters.jks<\/strong>:<\/p>\n<p>\n<em>&nbsp; &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias root -file root.cer -keystore adapters.jks -storepass ***<br \/>\n&nbsp; &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias intermediate -file Intermediate.cer -keystore adapters.jks -storepass ***<br \/>\n&nbsp; &nbsp; [user@host cert]$ keytool -import -trustcacerts -alias Alias_Name -file your_domain.cer -keystore adapters.jks -storepass ***<\/em><\/p>\n<p><strong>&nbsp;Step 4: Secure the provider implementation<\/strong><\/p>\n<p><strong>4A: Select the provider<\/strong><\/p>\n<ol>\n<li>Go to <strong>Home &gt;Summary of Security Realms &gt;myrealm &gt; Providers &gt; AD &gt; Provider Specific<\/strong>.<\/li>\n<li>Click on the provider on which you want to secure authentication. Here, I used AD as an&nbsp;example.<\/li>\n<\/ol>\n<p><strong>4B: Enable SSL<\/strong><\/p>\n<p>Click on the checkbox before <strong>SSL Enabled<\/strong>&nbsp;and make sure to use a secure provider port.<br \/>\nBy default, <em>`636<\/em>` is a secure port. However, check with your AD provider&#8217;s support team.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26493-body-Picture3_13.png\" alt=\"weblogic pic 3\" \/><\/p>\n<p><strong>Step 5: Make Weblogic configuration changes from the backend<\/strong><br \/>\nUse the following steps to update the Weblogic configuration:<\/p>\n<p><strong>5A: Update Java properties<\/strong><\/p>\n<p>1. Go to <strong>$DOMAIN_HOME\/bin<\/strong> and save a backup of <strong>setDomainEnv.sh<\/strong>.<\/p>\n<p>2. Add the following to section <strong>EXTRA_JAVA_PROPERTIES<\/strong>&nbsp;in <strong>setDomainEnv.sh<\/strong>&nbsp;by using an editor such as `<em>vi`<\/em>:<\/p>\n<p><em>&nbsp; Djavax.net.ssl.trustStore=&#8221;&lt;Location of &nbsp;your_domain.jks &gt;&#8221; -Djavax.net.ssl.trustStorePassword=&#8221;****&#8221; -Dcom.sun.jndi.ldap.connect.pool.protocol=ssl<\/em><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26493-body-Picture4_8.png\" alt=\"weblogic pic 4\" \/><\/p>\n<p><strong>5B: Restart&nbsp;<\/strong><\/p>\n<p>Restart the Admin and Managed server by removing <strong>tmp<\/strong>&nbsp;and <strong>cache<\/strong><\/p>\n<p><strong>Step 6: Validations<\/strong><\/p>\n<p>1. Validate the Admin and Managed server logs to confirm that no errors occurred.<br \/>\n2. Check with the AD support team for the latest connection. Connection details should be<br \/>\n&nbsp; &nbsp;secure.<\/p>\n<p>The following example is for non-secure authentications. However, after you implement SSL,<br \/>\nthe connection should be secure.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26493-body-Picture5_7.png\" alt=\"weblogic pic 5\" \/><\/p>\n<p><strong>Conclusion<\/strong><\/p>\n<p>By following the steps in this post, you can easily secure an AD connection for applications&nbsp;deployed on Weblogic Server. The three major procedures (Enable SSL for AD, Additional SSL&nbsp;parameters in <strong>setDomainEnv.sh<\/strong>, and LibOVD adaptor configurations) comprise this&nbsp;implementation.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Secure Active Directory authentication for Weblogic Server<\/p>\n","protected":false},"author":2,"featured_media":7773,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26493","content_type":"blog","created_by":"10130","authored_on":"2024-01-14T16:51:08+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Enhance Microsoft Active Directory authentication for WebLogic Server with Secure Sockets Layer (SSL). Enable secure user validation.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26493-insights_image-security-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"On-Premises Security, Rackspace Security Essentials","product":"","publisheddate":"2020-10-28T15:51:08","rxt_solutions":"Security","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Active Directory Authentication Weblogic SSL | Rackspace","field_topics":"","field_slug":"secure-active-directory-authentication-for-weblogic-server","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7771","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7771"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7771\/revisions"}],"predecessor-version":[{"id":9666,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7771\/revisions\/9666"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7773"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}