You can create a fine-grained
administrative authorization group
by selecting administrative resources to be part of the authorization
group.
You can assign users or groups to this new administrative authorization
group
and also give them access to the administrative resources contained
within.
Before you begin
You must be logged
into the administrative console with cell-level Admin
Security Manager authority, or the primary administrative ID can
make
these changes as well.
Procedure
- Navigate to .
- Type a name for the administrative authorization
group into the Name field. This is a required field.
The name must be unique within the cell structure.
If the name is not unique then the new administrative authorization
group
is not created at the end of this procedure.
- Select
the resources from the Resource section to which you want
the new administrative authorization group to control access.
Resources
that are displayed in black text are available for selection.
Resources
that are displayed in grey are already members of a different administrative
authorization group. Therefore, these resources are not available
for inclusion
in the new administrative authorization group. When a resource is
a member
of a different authorization group, the name of the group displays
next to
the resource name. For example: server_1 (group_1)
Your filtering
options
include the following:
- Nodes. (All of the
resources associated with the nodes.)
- Servers. (All
of the resources associated with the servers.)
- Web
servers. (All of the resources associated with the web servers.)
- Clusters. (All of the resources associated with the clusters.)
- Applications. (All of the resources associated with the applications.)
- Node groups. (All of the resources associated with the Node
Groups.)
- All scopes. (The default view that displays
the authorization group
tree.)
- Assigned scopes. (Displays all of the scopes
explicitly assigned to
the current authorization group.)
- Click OK or Apply.
- If you want to associate a user role to this new
administrative
authorization group, do the following:
- Click Administrative
user roles located under the Additional
Properties section. The available user roles are the following:
- Administrator
- An individual or group that uses
the administrator role has the operator
and configurator privileges plus additional privileges that are granted
solely
to the administrator role. For example, an administrator can complete
the
following tasks:
- Modify the server user ID and password.
- Configure authentication and authorization mechanisms.
- Enable
or disable administrative security.
- Enable or disable Java 2
security.
- Change the Lightweight Third Party Authentication
(LTPA) password and
generate keys.
- Create, update, or delete users in the federated
repositories configuration.
- Create, update, or delete groups
in the federated repositories configuration.
Note: An administrator
cannot map users and groups to the administrator
roles.
.
- Configurator
- An
individual or group that uses the configurator role has the monitor
privilege plus the ability to change the WebSphere® Application
Server configuration.
The configurator can perform all the day-to-day configuration tasks.
For example,
a configurator can complete the following tasks:
- Deployer
- Users granted this role can
perform both configuration actions and runtime
operations on applications..
- Operator
- An individual or group that uses the operator role has monitor
privileges
plus ability to change the runtime state. For example, an operator
can complete
the following tasks:
- Stop and start the server.
- Monitor
the server status in the administrative console.
- Monitor
- An individual or group that
uses the monitor role has the least amount
of privileges. A monitor can complete the following tasks:
- View
the WebSphere Application
Server configuration.
- View the current state of the Application
Server.
- Admin Security Manager
- Using the Admin Security Manager role, you can assign users and
groups
to the administrative user roles and administrative group roles. However,
an administrator cannot assign users and groups to the administrative
user
roles and administrative group roles including the Admin Security
Manager
roles.
- Click Add....
The New User page is displayed.
- Select the appropriate role(s) from the Role(s) list
box.
- Select a user or users by entering
text in the Search string field,
and then click Search.. Click the arrow to add the available
user or
users to the Mapped to role field. You can select
multiple
users and roles by clicking Select All.
-
Click OK. You are returned to the Administrative
User Roles page. The new users are displayed in the Administrative
User Roles
table along with their appropriate roles.
- Repeat steps B through E for each new user to whom you
want
to map a role.
- If you
want to associate a group to this new user role, do the
following:
- Click Administrative group
roles located under the Additional
Properties section.
- Click Add....
The New Group page is
displayed.
- Select the appropriate
role or roles from the Role(s) list
box.
- Select a user or users by entering
text in the Search string field,
and then click Search.. Click the arrow to add the available
user or
users to the Mapped to role field. You can select
multiple
users and roles by clicking Select All.
-
Select either the Select from special subjects or Map
Groups As Specified Below option.
If you select
the Select
from special subjects option, you can select the EVERYONE, ALL
AUTHENTICATED,
or ALL AUTHENTICATED IN TRUSTED REALMS values.
A list of user
groups
and roles are displayed in the Available and Mapped to role fields.
Select the user groups from the Available field and then select
the
roles from the Mapped to role field to which you want the group
or
groups associated. You can select multiple groups and roles.
- Click OK. You are
returned to the Administrative
Group Roles page. The new group is displayed in the Administrative
Group Roles
table along with the role of the new group.
- Repeat steps B through E for each new group to whom
you want
to map a role.
- If you
want to create another administrative authorization group,
click Apply. The current administrative authorization
group is created. Repeat steps 2 through 6 to create another administrative
authorization group.
- If you do not want
to create another administrative authorization
group, click OK.