Administrative roles

The Java 2 Platform, Enterprise Edition (J2EE) role-based authorization concept is extended to protect the WebSphere Application Server administrative subsystem.

A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when global security is enabled. The following table describes the administrative roles:

Administrative roles
Role Description
Monitor An individual or group that uses the monitor role has the least amount of privileges. A monitor can complete the following tasks:
  • View the WebSphere Application Server configuration.
  • View the current state of the Application Server.
Configurator An individual or group that uses the configurator role has the monitor privilege plus the ability to change the WebSphere Application Server configuration. The configurator can perform all the day-to-day configuration tasks. For example, a configurator can complete the following tasks:
  • Create a resource.
  • Map an application server.
  • Install and uninstall an application.
  • Deploy an application.
  • Assign users and groups-to-role mapping for applications.
  • Set up Java 2 security permissions for applications.
  • Customize the Common Secure Interoperability Version 2 (CSIv2), Secure Authentication Service (SAS), and Secure Sockets Layer (SSL) configurations.
Operator An individual or group that uses the operator role has monitor privileges plus ability to change the runtime state. For example, an operator can complete the following tasks:
  • Stop and start the server.
  • Monitor the server status in the administrative console.
Administrator An individual or group that uses the administrator role has the operator and configurator privileges plus additional privileges that are granted solely to the administrator role. For example, an administrator can complete the following tasks:
  • Modify the server user ID and password.
  • Configure authentication and authorization mechanisms.
  • Enable or disable global security.
  • Enable or disable Java 2 security.
  • Change the Lightweight Third Party Authentication (LTPA) password and generate keys.
Note: An administrator cannot map users and groups to the administrator roles.

The server ID that is specified when enabling global security is automatically mapped to the administrator role.

Users and groups can be added or removed from the administrative roles from the WebSphere Application Server administrative console at any time. The Primary administrative user name must be used to log on to the administrative console to change the administrative user and group roles. A best practice is to map a group or groups, rather than specific users, to administrative roles because it is more flexible and easier to administer.

In addition to mapping user or groups, a special-subject can also be mapped to the administrative roles. A special-subject subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the administrative role ensures that the user making the request is at least authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.




Related concepts
Authorization technology
Related tasks
Assigning users to naming roles
Reference topic    

Terms of Use | Feedback

Last updated: Sep 20, 2010 11:08:29 PM CDT
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=vela&product=was-nd-mp&topic=rsecadminroles
File name: rsec_adminroles.html