Securing the external scheduler integration interface requires
securing the JobSchedulerMDI system application and the JMS resources
it uses.
About this task
The following diagram shows the actions required and the
environmental artifacts to which they apply:

The following
steps show you how to secure the external scheduler integration interface:
Procedure
- Enable bus security. Enable security for the
JobSchedulerBus in the WebSphere administrative console:
- Click Security > Bus security > bus_name.
- Check the Enable bus security check box.
- Click OK, then Save your configuration.
- Define a JAAS alias. The JobSchedulerMDI application’s
JMS activationSpec requires a JAAS alias. Give the JAAS alias a name
of your choice. The User ID and password defined to this alias represents
the job scheduler’s access to its inbound JMS queue, com.ibm.ws.grid.InputQueue.
The JAAS alias is also used programmatically by the JobSchedulerMDI
application for authenticating to the outbound queue that the job
scheduler uses to communicate with its clients. The outbound queue
is com.ibm.ws.grid.OutputQueue. Define the JAAS alias in the WebSphere
administrative console:
- Select Security > Secure administration, applications,
and infrastrucure > Java Authentication and Authorization Server >
J2C authentication data.
- Save your configuration.
- Assign the JAAS alias t to the activationSpec, com.ibm.ws.grid.ActivationSpec
- Assign roles. Roles must be assigned to authorize
access to the bus and input and output bus destinations. These role
assignments can be performed in the WebSphere administrative console: Security > Bus security > bus_name > Disabled > Users
and groups in the bus connector role. This can also be done through
wsadmin commands:
$AdminTask addUserToBusConnectorRole {-bus busName -user username} or
$AdminTask
addGroupToBusConnectorRole {-bus busName –group groupname}
The following role assignments must be made:
- JobSchedulerBus Assign the BusConnector
role to the following user IDs:
- Identity assigned to com.ibm.ws.grid.ActivationSpec. This permits
the JobScheduler to access the bus.
- Each identity used by WSGrid to authenticate client access to
the input queue (see step 4 below). This permits the WSGrid invoker
to access the bus.
- com.ibm.ws.grid.InputQueue Permit
access to this destination by assigning sender, receiver, and browser
roles to the same user IDs to which you assigned the BusConnector
role in the previous step. This can only be done through wsadmin commands:
$AdminTask addUserToDestinationRole {-type queue –bus
JobSchedulerBus -destination com.ibm.ws.grid.InputQueue -role Sender -user userName}
$AdminTask addGroupToDestinationRole {-type queue –bus
JobSchedulerBus -destination com.ibm.ws.grid.InputQueue -role Sender –group groupName}
AdminTask.setInheritDefaultsForDestination('-bus WSS.JobScheduler.Bus -type queue -destination com.ibm.ws.grid.InputQueue -inherit false'
Repeat for receiver and browser roles.
- com.ibm.ws.grid.OutputQueue
Permit
access to this destination by assigning the same roles to destination
com.ibm.ws.grid.OutputQueue as were assigned for com.ibm.ws.grid.InputQueue
in the previous step.
- Authenticate client access to input queue. Specify
user ID and password properties in the WSGrid input control properties
file. For example, submitter-userid=username, submitter-password=password. The password can be encoded using the WebSphere PropFilePasswordEncoder
utility.