Role | Description |
Monitor | An individual or group that uses the monitor
role has the least amount of privileges. A monitor can complete the following
tasks:
|
Configurator | An individual or group that uses the configurator
role has the monitor privilege plus the ability to change the WebSphere Application
Server configuration. The configurator can perform all the day-to-day configuration
tasks. For example, a configurator can complete the following tasks:
|
Operator | An individual or group that uses the operator
role has monitor privileges plus ability to change the run time state. For
example, an operator can complete the following tasks:
|
Administrator | An individual or group that uses the administrator
role has the operator and configurator privileges plus additional privileges
that are granted solely to the administrator role. For example, an administrator
can complete the following tasks:
|
The identity specified when enabling global security is automatically mapped to the administrator role. Users, groups, can be added or removed from the admin roles from the WebSphere Application Server administrative console at anytime. However, a server restart is required for the changes to take effect. A best practice is to map a group or groups, rather than specific users, to admin roles because it is more flexible and easier to administer in the long run. By mapping a group to an admin role, adding or removing users to or from the group occurs outside of WebSphere Application Server and does not require a server restart for the change to take effect.
In addition to mapping user or groups, a special-subject can also be mapped to the admin roles. A special-subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the admin role ensures that the user making the request has at least been authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.