Oracle WebLogic Server 11g Administration Handbook

The Deployment Descriptor Only Model

The Deployment Descriptor Only (DD Only) security model, which is another name for the standard Java EE security model, only uses the groups, roles, and security policies defined in the web.xml, weblogic.xml, ejb-jar.xml, and weblogic-ejb-jar.xml deployment descriptors. Developers define the roles and security polices in the deployment descriptors. The developer maps the EJBs and web URLs to roles and maps the roles to principals (users or groups). The administrator ensures that the roles and groups exist and that they are mapped correctly in the realm. Under the DD Only security model, the security framework performs a security check only when clients request a URL or EJB method that is protected by policies ...