Most of the Application use
“OAM_REMOTE_USER” or “Proxy-remote-user” for the SSO setup which is sent by OAM
in the Header. But some applications (like some Apex apoplications) still use
“REMOTE_USER” for SSO with OAM. This Remote_user is generated by Weblogic
itself based on the user authenticated and retrieved by method
“request.getRemoteUser()”. With version 10.3.x this method was deprecated and
not enabled automatically with start of weblogic as it opens a security
vulnerability. However this Remote user can be enabled explicitly when weblogic
is started with the Run time argument “-Dweblogic.http.enableRemoteUserHeader=true”. Add this value in JAVA Properties of setDomainenv.sh
and Remote user will be enabled. Please note that this is not preferred way to
do that as the logged in user can be retrieved with “proxy-remote-user” header
but can be solution in the case many applications are using
“request.getRemoteUser()” method for SSO setup.
Hello Shikhar, Can you please help me out in Enabling Remote User in Integrated Weblogic server 11g environment. I've tried to make these settings in both the setDomainenv.sh and also the startWebLogic.cmd files, but the value is coming as "Null", any leads would be great. Thanks in advance.
ReplyDeleteWhich Weblogic version are you using ? I have checked this with 10.3.6 version and it works. I searched on Oracle support site and found this note: Session Data Randomly Lost in WSRP Portlet Due to HttpServletRequest.getRemoteUser() Returning Null (Doc ID 964822.1). If you have access of support site look at this note.
Delete