WLS10.3.6/WDT0.21 - domain build always creates a security realm called 'myrealm'

[53d117460ec63d70]

Extract from my model generated from domain discovery:

        Realm:
            robrealm:
                Adjudicator:
                    DefaultAdjudicator:
                        DefaultAdjudicator:
                AuthenticationProvider:
                    DefaultAuthenticator:
                        DefaultAuthenticator:
                    DefaultIdentityAsserter:
                        DefaultIdentityAsserter:
                            ActiveType: [ AuthenticatedUser ]
                Authorizer:
                    XACMLAuthorizer:
                        XACMLAuthorizer:
                            PolicyDeploymentEnabled: true
                CertPathProvider:
                    WebLogicCertPathProvider:
                        WebLogicCertPathProvider:
                CredentialMapper:
                    DefaultCredentialMapper:
                        DefaultCredentialMapper:
                RoleMapper:
                    XACMLRoleMapper:
                        XACMLRoleMapper:

This creates a config.xml with the following security realm configuration:

    <realm>
      <sec:authentication-provider xsi:type="wls:default-authenticatorType"/>
      <sec:authentication-provider xsi:type="wls:default-identity-asserterType">
        <sec:active-type>AuthenticatedUser</sec:active-type>
      </sec:authentication-provider>
      <sec:role-mapper xsi:type="xacml:xacml-role-mapperType"/>
      <sec:authorizer xsi:type="xacml:xacml-authorizerType"/>
      <sec:adjudicator xsi:type="wls:default-adjudicatorType"/>
      <sec:credential-mapper xsi:type="wls:default-credential-mapperType"/>
      <sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType"/>
      <sec:cert-path-builder>WebLogicCertPathProvider</sec:cert-path-builder>
      <sec:name>myrealm</sec:name>
      <sec:password-validator xsi:type="pas:system-password-validatorType">
        <sec:name>SystemPasswordValidator</sec:name>
        <pas:min-password-length>8</pas:min-password-length>
        <pas:min-numeric-or-special-characters>1</pas:min-numeric-or-special-characters>
      </sec:password-validator>
    </realm>
    <realm>
      <sec:authentication-provider xsi:type="wls:default-authenticatorType">
        <sec:name>DefaultAuthenticator</sec:name>
      </sec:authentication-provider>
      <sec:authentication-provider xsi:type="wls:default-identity-asserterType">
        <sec:name>DefaultIdentityAsserter</sec:name>
        <sec:active-type>AuthenticatedUser</sec:active-type>
      </sec:authentication-provider>
      <sec:role-mapper xsi:type="xacml:xacml-role-mapperType">
        <sec:name>XACMLRoleMapper</sec:name>
      </sec:role-mapper>
      <sec:authorizer xsi:type="xacml:xacml-authorizerType">
        <sec:name>XACMLAuthorizer</sec:name>
      </sec:authorizer>
      <sec:credential-mapper xsi:type="wls:default-credential-mapperType">
        <sec:name>DefaultCredentialMapper</sec:name>
      </sec:credential-mapper>
      <sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType">
        <sec:name>WebLogicCertPathProvider</sec:name>
      </sec:cert-path-provider>
      <sec:name>robrealm</sec:name>
    </realm>
    <default-realm>myrealm</default-realm>

Is there a way that I can prevent 'myrealm' from getting generated?

[CarolynRountree]

The current WDT does not remove myrealm. It also discovered to the model along with your default realm. Realm myrealm is installed by the base WLST template during the createDomain. We have circled around this topic a few times. As long as the default realm is set to your security realm, they should co-exist peacefully (I see your other Issue related to setting default). Could you comment on why you feel the myrealm should be removed please and we will discuss again.

[53d117460ec63d70]

We have a number of WLS configurations and are going through a process of generating models for each using discoverDomain.sh. We then use createDomain.sh to build from each of the models. Ideally the discovered domain and the created domain should be identical. This would make it easier for us to adopt WDT as any deltas will need to be justified. I'm already patching config.xml for a couple of the WLST offline quirks and could also do so for the 'myrealm' that gets created but it would be preferable to have all this codified in the model.

Oh, and thank you all for developing this brilliant tool!

[rakillen]

Issue #144 (PR #422) allows for removal of named elements by flagging them in the model. This will be in the upcoming release 1.3.0. The README describes the specific case of myrealm, at:
https://github.com/oracle/weblogic-deploy-tooling#declaring-named-mbeans-to-delete

[ddsharpe]

Fixed by #422