You can use fine-grained administrative security in heterogeneous or single-server environments. This capability enables you to use fine-grained administrative security for nodes that were created on different versions of the product, and applications that are grouped and placed in different authorization groups.
Product support of heterogeneous systems enables the deployment manager node to run at the currently installed version of the product, while other nodes run at lower versions of the product that are compatible with the currently installed version.
Because the configurations that are done in the deployment manager node are always at the version of the product on which you are currently running, fine-grained administrative security can be enforced when configuring resources that belong to earlier versions. However, run-time code for versions lower than Version 6.1 cannot enforce fine-grained administrative security. Therefore, any resource instance that is not part of a Version 6.1 or higher node cannot be added to an authorization group.
You can also use fine-grained administrative security in a single-server environment. This capability means that you can group various applications in the single server, and place them in different authorization groups. Therefore, different authorization constraints might exist for different applications.
After the administrative resource is removed from the authorization group, the administrative authorizer runtime must be notified by using the AuthorizationManager refreshAll MBean method.
The refreshAll command must be invoked after AdminConfig.save() and sync nodes. For example:
// get AuthorizationGroup Mbean wsadmin> set agBean [$AdminControl queryNames type=AuthorizationGroupManager,process=dmgr,*] wsadmin> $AdminControl invoke &agBean refreshAll
// get AuthorizationGroup Mbean wsadmin> set agBean AdminControl.queryNames('type=AuthorizationGroupManager,process=dmgr,*') wsadmin> AdminControl.invoke(agBean, 'refreshAll')
The server restart is no longer needed.
Each application
server in the cell will be refreshed automatically when the refreshAll command
is issued to the AuthorizationGroupManager MBean in the deployment
manager or an administrative agent. All registered servers will be
notified.