Notes on Oracle WebLogic Server configuration, tooling, and security. Lab environment runs WLS 14.1.2.0 on reishi (AWS EC2, eu-central-1), provisioned via ansible/playbooks (deploy_weblogic_ldap.yml).
config-xml-admin-port — Reference config.xml for AdminServer with admin port enabled on 9003 (WLS 14.1.2.0). Includes corrections on element ordering and WLS default-omission behaviour.
enableHSTS-findings — live-tested: enableHSTS sends Strict-Transport-Security on the Admin Console on both 12.2.1.4 and 14.1.2.0, including the admin port; also documents that SSL and the admin port are OFF by default on a freshly-created domain despite a comment claiming otherwise.
Derek/weblogic-remote-console — WebLogic Remote Console (Electron/Helidon AppImage). How to run the backend headlessly, add a provider, and activate changes.
Derek/access-controls-WLST — Analysis of the audit finding on WLST access controls. Root cause: hardcoded portal credential. Short-term fix: WebLogic connection filter. Proper fix: CyberArk credential retrieval + portal authentication.