Enabling security

By enabling security, you protect your server from unauthorized users and are then able to provide application isolation and requirements for authenticating application users.

Before you begin

It is helpful to understand security from an infrastructure perspective so that you know the advantages of different authentication mechanisms, user registries, authentication protocols, and so on. Picking the right security components to meet your needs is a part of configuring security. The following sections help you make these decisions.

After you understand the security components, you can proceed to configure security in WebSphere® Application Server.

Procedure

  1. Start the WebSphere Application Server administrative console.

    If security is currently disabled, you are prompted for a user ID. Log in with any user ID. However, if security is currently enabled, you are prompted for both a user ID and a password. Log in with a predefined administrative user ID and password.

  2. Click Security > Global security.

    Use the Security Configuration Wizard, or configure security manually. The configuration order is not important.

    Avoid trouble: You must separately enable administrative security, and application security. Because of this split, WebSphere Application Server clients must know whether application security is disabled at the target server. Administrative security is enabled, by default. Application security is disabled, by default. Before you attempt to enable application security on the target server, verify that administrative security is enabled on that server. Application security can be in effect only when administrative security is enabled.gotcha

    For more information on manual configuration, see Authenticating users.

  3. Configure the user account repository. For more information, see Selecting a registry or repository. On the Global security panel, you can configure user account repositories such as federated repositories, local operating system, standalone Lightweight Directory Access Protocol (LDAP) registry, and standalone custom registry.
    Note: You can choose to specify either a server ID and password for interoperability or enable a WebSphere Application Server installation to automatically generate an internal server ID. For more information about automatically generating server IDs, see Local operating system settings.

    One of the details common to all user registries or repositories is the Primary administrative user name. This ID is a member of the chosen repository, but also has special privileges in WebSphere Application Server. The privileges for this ID and the privileges that are associated with the administrative role ID are the same. The Primary administrative user name can access all of the protected administrative methods.

    [Windows] The ID must not be the same name as the machine name of your system because the repository sometimes returns machine-specific information when querying a user of the same name.

    In standalone LDAP registries, verify that the Primary administrative user name is a member of the repository and not just the LDAP administrative role ID. The entry must be searchable.

    [AIX Solaris HP-UX Linux Windows] The Primary administrative user name does not run WebSphere Application Server processes. Rather, the process ID runs the WebSphere Application Server processes.

    [AIX Solaris HP-UX Linux Windows] The process ID is determined by the way the process starts. For example, if you use a command line to start processes, the user ID that is logged into the system is the process ID. If running as a service, the user ID that is logged into the system is the user ID running the service. If you choose the local operating system registry, the process ID requires special privileges to call the operating system APIs. The process ID must have the following platform-specific privileges:
    • [Windows] Act as Part of Operating System privileges
    • [AIX HP-UX Solaris] Root privileges

    [z/OS] When you use the standalone local operating system registry on WebSphere Application Server for z/OS®, the user ID for the server is not set using the administrative console, but is set through the STARTED class in the z/OS operating system.

  4. Select the Set as current option after you configure the user account repository. When you click Apply and the Enable administrative security option is set, a verification occurs to see if an administrative user ID has been configured and is present in the active user registry. The administrative user ID can be specified at the active user registry panel or from the console users link. If you do not configure an administrative ID for the active user registry, the validation fails.
    Note: When you switch user registries, the admin-authz.xml file should be cleared of existing administrative ids and application names. Exceptions will occur in the logs for ids that exist in the admin-authz.xml file but do not exist in the current user registry.
  5. Configure the authentication mechanism.

    Configure Lightweight Third-Party Authentication (LTPA) or Kerberos, which is new to this release of WebSphere Application Server, under Authentication mechanisms and expiration. LTPA credentials can be forwarded to other machines. For security reasons, credential expire; however, you can configure the expiration dates on the console. LTPA credentials enable browsers to visit different product servers, which means you do not have to authenticate multiple times.

    [z/OS] Note: You can configure Simple WebSphere Authentication Mechanism (SWAM) as your authentication mechanism. However, SWAM was deprecated in WebSphere Application Server Version 7.0 and will be removed in a future release. SWAM credentials are not forwardable to other machines and for that reason do not expire.
  6. Click Security > Global security to configure the rest of the security settings and enable security. For information about these settings, see Global security settings.
  7. Validate the completed security configuration by clicking OK or Apply. If problems occur, they display at the top of the console page in red type.
  8. If there are no validation problems, click Save to save the settings to a file that the server uses when it restarts. Saving writes the settings to the configuration repository.
    Important: If you do not click Apply or OK in the Global security panel before you click Save, your changes are not written to the repository. The server must be restarted for any changes to take effect when you start the administrative console.
  9. Start the WebSphere Application Server administrative console.

    If security is currently disabled, log in with any user ID. If security is currently enabled, log in with a predefined administrative ID and password. This ID is typically the server user ID that is specified when you configured the user registry.




In this information ...


IBM Redbooks, demos, education, and more

(Index)

Use IBM Suggests to retrieve related content from ibm.com and beyond, identified for your convenience.

This feature requires Internet access.

Task topic    

Terms of Use | Feedback

Last updated: Oct 22, 2010 3:02:28 AM CDT
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=v700osgijpa&product=was-nd-mp&topic=tsec_csec2
File name: tsec_csec2.html