Before you begin
The task of assigning users and groups to administrative roles
is performed to identify users for performing WebSphere Application Server
administrative functions. Administrator roles are used to control access to
WebSphere Application Server administrative functions. There are four roles:
administrator, configurator, operator and monitor.
- Monitor role
- An individual or group that uses the monitor role has the least amount
of privileges. A monitor can complete the following tasks:
- View the WebSphere Application Server configuration.
- View the current state of the Application Server.
- Configurator role
- An individual or group that uses the configurator role has the monitor
privilege plus the ability to change the WebSphere Application Server configuration.
The configurator can perform all the day-to-day configuration tasks. For example,
a configurator can complete the following tasks:
- Create a resource.
- Map an application server.
- Install and uninstall an application.
- Deploy an application.
- Assign users and groups-to-role mapping for applications.
- Set up Java 2 security permissions for applications.
- Customize the Common Secure
Interoperability Version 2 (CSIv2), Security Authentication Service (SAS),
and Secure Sockets Layer (SSL) configurations.
- Operator role
- An individual or group that uses the operator role has monitor privileges
plus ability to change the run time state. For example, an operator can complete
the following tasks:
- Stop and start the server.
- Monitor the server status in the administrative console.
- Administrator role
- An individual or group that uses the administrator role has the operator
and configurator privileges plus additional privileges that are granted solely
to the administrator role. For example, an administrator can complete the
following tasks:
- Modify the server user ID and password.
- Map users and groups to the administrator role.
- Configure authentication and authorization mechanisms.
- Enable or disable global security.
- Enable or disable Java 2 security.
- Change the Lightweight Third Party Authentication (LTPA) password and
generate keys.
Before you assign users to administrative roles, you
must set up your user registry, which can be Lightweight Directory Access
Protocol (LDAP), local OS, or a custom registry. You can set up your user
registries without enabling security.
The
following steps are needed to assign users to administrative roles.
Why and when to perform this task
In the administrative console, click
System Administration > Console
settings. Click either
Console Users or
Console Groups.
What to do next
After you assign
users to administrative roles, you must restart the Deployment Manager for
the new roles to take effect. However, the administrative resources are not
protected until you enable security.