Oracle WebLogic Server 11g Administration Handbook

The Custom Roles and Policies Model

The Custom Roles and Policies security model goes beyond the Custom Roles model by letting the administrator create all roles, security policies, and role mappings, and completely ignores any security definitions in the deployment descriptors. This is a more streamlined approach to managing security, as the administrator defines all security requirements including the roles, security policies, and role mappings centrally through the Administration Console. This centralization of application security configuration makes updating security definitions much easier than in the DD Only or Custom Roles security models.

The drawback with this security model is that it doesn't provide fine-grained security checks based ...