WebLogic bypass basic authentication Tips

Bypassing Basic Authentication

Client requests in WebLogic that use HTTP BASIC authentication must pass WebLogic Server authentication, even if access control is not enabled on the target resource. The behavior can be controlled with the flag enforce-valid-basic-auth-credentials. This configures whether or not the system should allow requests with invalid HTTP BASIC authentication to access unsecured resources. You have to be careful with this setting as this affects the complete domain. If you explicitly set the enforce-valid-basic-auth-credentials flag to false, WebLogic Server does not perform authentication for HTTP BASIC authentication client requests for which access control was not enabled for the target resource.

Note that this setting is one of the options which CANNOT be set using the AdminConsole. Therefore you need to either set this offline manually in the config.xml (strongly discouraged) or use WLST.

Example WLST script:

This change requires a server restart after the change has been activated.

Advanced WebLogic Server Automation Book The above is an excerpt from the book "Advanced WebLogic Server Automation: Administration and Monitoring with WLST and JMX". This book covers everything administrators need to know for WebLogic scripting and automation, and includes a comprehensive code download of powerful WLST and JMX scripts.

Burleson is the American Team Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum. Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications. Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:   and include the URL for the page.                      Burleson Consulting The Oracle of Database Support Oracle Performance Tuning Remote DBA Services   Copyright © 1996 -  2020 All rights reserved by Burleson Oracle ® is the registered trademark of Oracle Corporation.