title: Manual Weblogic Basic Authentication
body: <p>I have a Web Service (JAX-WS), a WSDL, a desktop application Client, and a Weblogic 12c server. I am trying to implement basic authentication between the <code>Client-&gt;Web Service-&gt;Weblogic-&gt;Active Directory</code>. I have been able to set everything up by putting the Username/Password in the header of the SOAP message when sending it from the Client to the Web Service.</p>
  
  <p>Weblogic automatically pulls that header info and authenticates a user against Active Directory. Great. But the issues at hand are thse: </p>
  
  <ol>
  <li>Should I <strong><em>not</em></strong> send credentials in the header <em>at all</em>, it doesn't authenticate but allows full access to anonymous users. 
  <ul>
  <li>I need to send a proper error message and prevent anonymous usage.</li>
  </ul></li>
  <li>Should I send <strong><em>invalid</em></strong> credentials it throws a <code>socket read</code> exception on the client.
  <ul>
  <li>I need to send back a proper error message; rather than having it bomb out on the client.</li>
  </ul></li>
  <li>Should I send <strong><em>valid</em></strong> credentials but <strong><em>invalid</em></strong> authorization; I have setup <code>@RolesAllowed({"SomeRole"})</code> on each of my <code>Stateless EJB</code> methods. It throws a security vilotion exception on the Web Service side of the house.
  <ul>
  <li>I need to somehow catch this exception and send back a proper message to the client</li>
  </ul></li>
  </ol>
  
  <p>Is there a way to do all of this without customizing the Weblogic Domain? It feels like I need to manually take control of the Basic Authentication of Weblogic but then I feel like I am stepping the <code>JAAS Login Module</code> of weblogic -- which customizes the domain and I want to avoid. </p>