Summary

With the introduction of a new security service, WebLogic Server allows security constraints to be completely abstracted from a J2EE application, which makes security easier to install, maintain, and modify as the application's business requirements change over time. To support this security model, the WebLogic Security Service has shifted away from using ACLs to using a framework that leverages several security providers, with each security provider supporting a specific function related to application security. Also, one or more security plug-ins can be used for a security function.

This chapter has given you a clear, concise description of the new WebLogic Server Security Service and demonstrated how you can manage and leverage the BEA-supplied security plug-ins to implement security for a simple Web application.