The Java 2 Platform, Enterprise Edition (J2EE) role-based authorization concept is extended to protect the WebSphere Process Server administrative subsystem. A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when global security is enabled.
Role | Description |
---|---|
monitor | Least privileged; can view the WebSphere Process Server configuration and current state. |
configurator | Monitor privilege plus the ability to change the WebSphere Process Server configuration. |
operator | Monitor privilege plus the ability to change the run-time state, such as starting or stopping services. |
administrator | Operator and configurator privilege, plus additional
privileges granted solely to the administrator role. Examples include:
|
The server ID that is specified when enabling global security is automatically mapped to the administrator role. Users, groups, can be added or removed from the administrative roles from the WebSphere Process Server administrative console at any time. However, a server restart is required for the changes to take effect. A best practice is to map a group or groups, rather than specific users, to administrative roles because it is more flexible and easier to administer. By mapping a group to an administrative role, adding or removing users to or from the group occurs outside of WebSphere Process Server and does not require a server restart for the change to take effect.
In addition to mapping user or groups, a special-subject can also be mapped to the administrative roles. A special-subject subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the administrative role ensures that the user making the request is at least authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.
Last updated:
Copyright IBM Corporation 2005.
This information center is powered by Eclipse technology (http://www.eclipse.org)