Administrative security roles

Four administrative security roles are provided as part of the WebSphere Process Server installation.

There are four roles provided as part of the administrative console. These roles grant permission to ranges of functionality on the administrative console. When global security is enabled, a user must be mapped to one of these four roles in order to access the administrative console.

The first user to log in to the server after installation is added to the administrator role.

Table 1. Administrative security roles
Administrative security role Description
Monitor A member of the monitor role can view the WebSphere Process Server configuration and the current state of the server.
Configurator A member of the configurator role can edit the WebSphere Process Server configuration.
Operator A member of the operator role has monitor privileges, plus the ability to modify the runtime state, i.e., start and stop the server.
Administrator The administrator role is a combination of configurator and operator roles plus additional privileges granted solely to the administrator role. Examples include:
  • Modifying the server user ID and password
  • Mapping users and groups to the administrator role
Also has permission required to access sensitive information such as:
  • LTPA password
  • keys
.

The server ID that is specified when you enable global security is automatically mapped to the administrator role. Users or groups can be added to and removed from the administrative roles at any time through the WebSphere Process Server administrative console. However, a server restart is required for the changes to take effect. A best practice is to map a group or groups, rather than specific users, to administrative roles because it is more flexible and easier to administer. By mapping a group to an administrative role, adding or removing users to or from the group occurs outside of WebSphere Process Server and does not require a server restart for the change to take effect.

In addition to mapping users or groups, a special-subject can also be mapped to the administrative roles. A special-subject is a generalization of a particular class of users. The AllAuthenticated special-subject means that the access check of the administrative role ensures that the user making the request is at least authenticated. The Everyone special-subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.


Last updated: Tue 24 Oct 2006 22:01:09

(c) Copyright IBM Corporation 2005, 2006.
This information center is powered by Eclipse technology (http://www.eclipse.org)