Credential Mapper for WebLogic Database Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Application servers using JDBC connection pools often provide anonymous access to databases, limiting the ability to enforce role-based access control and data security, as objects within the server lack specific credential information to provide to database APIs.
Innovation Solution
Implementing a credential mapper that maps the security context of application server threads into database-specific credentials, allowing for more granular access control and eliminating the need for users to provide additional credentials, with the option to configure this feature through a 'CredentialMappingEnabled' attribute and utilizing vendor-specific APIs for secure identity propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If JDBC connection pools provide anonymous access to databases, then connection pooling and access speed are improved, but role-based access control and data security are limited
Solution Approach 1:
The patent introduces a credential mapper as an intermediary component between the application server and the database. This mediator translates generic anonymous connection pool credentials into database-specific user credentials, enabling role-based access control while maintaining the efficiency of connection pooling. The credential mapper sits in the JDBC layer, converting security contexts into database usernames and passwords without requiring changes to the connection pool architecture.
2Ease of operation
If objects in the application server use connection pools, then connection management is simplified, but objects lack specific credential information to provide to database APIs
Solution Approach 1:
The credential mapper performs preliminary action by pre-establishing mapping relationships between application server security contexts and database credentials. Before database operations occur, the system prepares and stores the mapping configuration, allowing objects to automatically receive appropriate credentials when connecting through the pool without needing to manually provide credential information.
Solution Approach 2:
The credential mapper acts as an information bridge, capturing security context details from the application server side and translating them into database-specific credentials. This intermediary preserves the necessary credential information that would otherwise be lost in the anonymous connection pool architecture.
3Device complexity
If anonymous credentials are used in connection pools, then device complexity is reduced, but auditing and access-control capabilities are impaired
Solution Approach 1:
The credential mapper serves as a transparent intermediary that maintains simple anonymous credentials in the connection pool while automatically injecting the necessary access control information at the database interaction layer. This preserves auditing capabilities without adding complexity to the connection pool configuration or object-level code.
Data Source
AI summary
A connection pool can use a credential mapper to map credentials for an application server into a credential to use with the database management system. This can allow objects such as an Enterprise Java Bean to access the database with more specific credentials than the anonymous connection pool connection user name/password.