WebSphere brand IBM WebSphere Premises Server, Version 6.1.x

Enabling security

Scripts are provided to enable WebSphere® Application Server security for WebSphere Premises Server and for Location Awareness Services for WebSphere Premises Server. You can also use these scripts to disable security at a later time.

The following are a few key concepts that you should understand about WebSphere Application Server security for WebSphere Premises Server and for Location Awareness Services for WebSphere Premises Server:

Enabling security for WebSphere Premises Server

Before you begin

The ws_security script enables WebSphere Application Server security. Before running the ws_security script, ensure the following:

  • A local user exists
  • Or a local user group exists and has users in it

You will set a local user as the WebSphere Application Server administrative user so that after WebSphere Application Server security is enabled, you can sign on to the WebSphere Application Server administrative console as an administrator. If you want your WebSphere Application Server administrative user to have administrator access to the WebSphere Premises Server Administrative Console as well, then that user must be in the ibmrfid group.

Procedure
  1. Navigate to the security directory:

    Windows IBM_RFID_HOME\premises\install\security\

    Linux IBM_RFID_HOME/premises/install/security/

  2. Run the following command:
    ws_security enable userid password
    • userid = Local OS user ID

      This is the user ID of the WebSphere Application Server administrator. This user must be ibmrfidadmin or must belong to the group called ibmrfid if you want the user to have administrative access to the WebSphere Premises Server Administrative Console. The WebSphere Application Server administrator ID cannot be the same as the name of your server because the repository sometimes returns server-specific information when querying a user of the same name. For more information, refer to the Local operating system settings topic in the WebSphere Application Server Information Center.

      If you have installed Location Awareness Services for WebSphere Premises Server, a WebSphere Application Server administrative user ID also has to be set in atlas.config.bat file under WASADMIN.

    • password = Local OS password.

      This is the password of the WebSphere Application Server administrator.

      If you have installed Location Awareness Services for WebSphere Premises Server, a WebSphere Application Server administrative password also has to be set in atlas.config.bat file under WASPSWD.

Enabling security for Location Awareness Services for WebSphere Premises Server

Complete the following steps to configure security for WebSphere Application Server when you have Location Awareness Services for WebSphere Premises Server installed. Enabling security in WebSphere Application Server provides security for the Spatial Management Client and portlets.

About this task
Note: You should not perform the steps if Location Awareness Services for WebSphere Premises Server is not installed.
Procedure
  1. If you have not already done so, follow the steps to run the ws_security script and enable security for WebSphere Application Server.
  2. Navigate to the root installation directory of Location Awareness Services for WebSphere Premises Server (such as, C:\LAS).
  3. Edit the atlas.config.bat file and define the values for WASADMIN and WASPSWD.

    The script expects that WebSphere Application Server security is already enabled. The values for WASADMIN and WASPSWD should reflect the WebSphere Application Server administrative user ID and password, respectively. These values can match the user ID and password that you used previously with the ws_security script, or they can match the ID and password for another WebSphere Application Server administrative user that you have set.

  4. Open a command prompt and change to the LAS_HOME\WAS\scripts directory.
  5. Run the ATLASWAS_SecurityConfig.bat file by typing ATLASWAS_SecurityConfig at the command-line prompt.
    The script completes the following actions:
    • Creates the following groups on the operating system: lassmcadministergrp, lasmonitorgrp, lasoperategrp, lasadministergrp, laslocategrp, lasregistrategrp, lasconfiguregrp, and lascustomizegrp.
    • Creates the user lasoveradmin with password lasoveradmin. This superuser can run Location Awareness Services for WebSphere Premises Server functions in the WebSphere Application Server administrative console. Use the lasoveradmin superuser for testing or proof-of-concept environments only. The lasoveradmin user should not be used in production environments.
    • Applies security settings.
  6. Configure security for AtlasBus. Complete these steps to ensure that you can import data into Location Awareness Services for WebSphere Premises Server.
    1. Open the WebSphere Application Server administrative console and log in with your WebSphere Application Server administrative user ID and password.
    2. Select Security > Secure administration, applications and infrastructure > Java Authentication and Authorization Service > J2C Authentication Data.
    3. From the list select AtlasMEAuthentication and specify your WebSphere Application Server administrative user ID and password.
    4. Click OK and save your change.
    5. Navigate to Security > Bus Security > AtlasBus.
    6. Select Security under Additional Properties.
    7. Check Enable bus security and select AtlasMEAuthentication as the inter-engine authentication alias.
    8. For Permitted transports, choose the radio button to Restrict the use of defined transport channel chains to those protected by SSL.
    9. Click Apply.
    10. Under Additional Properties, click Users and groups in the bus connector role.
    11. If there is no entry for the user, click New > User name, enter your WebSphere Application Server administrative user ID for AtlasMEAuthentication in the text field and click OK.
    12. Navigate to Resources > JMS > Queue connection factories > AtlasImportQueueConnectionFactory.
    13. Under Advanced Administrative, select AtlasMEAuthentication as the Component-managed authentication alias.
    14. Save your changes.
    15. Navigate to Applications > Enterprise Applications > AtlasImportEAR.
    16. Under References, click Resource References and perform the following steps:
      • Under Specify authentication method, select Use default method (many-to-one mapping) and then select AtlasMEAuthentication as the authentication data entry.
      • In the table at the bottom of the page, select jms/AtlasImportConnectionFactory as the Target Resource JNDI Name.
      • Also in the table, check AtlasImportEJB and then click Apply.

      In the right hand column of the table for AtlasImportEJB, AtlasMEAuthentication should be listed as the authentication method.

    17. Click OK.
    18. Navigate to Resources > JMS > Activation specifications > AtlasCeiSubscribeAS and select AtlasMEAuthentication as the authentication alias.
    19. Click OK.
    20. Save the configuration.
  7. Navigate to Users and Groups > Administrative Group Roles.
  8. Assign the following roles to the following groups:
    Role Group
    lasadminister lasadministergrp
    laslocate laslocategrp
    lasregistrate lasregistrategrp
    lasmonitor lasmonitorgrp
    lasoperate lasoperategrp
    lasconfigure lasconfiguregrp
    lascustomize lascustomizegrp

    For each group, complete the following steps:

    1. If the group is listed on the Administrative Group Roles page, click the group name and then assign one or multiple roles.
    2. Click Apply to save your changes.
    3. If the group is not listed on the Administrative Group Roles page, click Add to add the group. Then assign one or multiple roles to the group.
    4. Click Apply to save your changes.
    5. Verify the correct roles are now assigned on the Administrative Group Roles page.
  9. Navigate to Security > Secure administration, applications, and infrastructure.
  10. Make sure that the following parameters are set:
    • Enable administrative security is selected.
    • Enable application security is selected.
    • Use Java 2 security to restrict application access to local resources is not selected.
    • Current realm definition is set to Local operating system.
    • Available realm definitions is set to Local operating system. Then click Configure and set Primary administrative user name to the WebSphere Application Server administrative user name and click Automatically generated server identity.
  11. Save your settings and restart WebSphere Application Server. You might need to enter the WebSphere Application Server user ID and password.
  12. Edit the LAS_HOME\AtlasIntegrator\Data_Export.properties file to specify the real host name of your server instead of localhost.
  13. Verify that security is running by logging into the WebSphere Application Server administrative console. If security is enabled, you are prompted for your WebSphere Application Server user ID and password. A random user ID is no longer accepted.
What to do next

Follow the steps in Configuring security for the Control Processing portlet.


Library | Support | Terms of use

(c) Copyright IBM Corporation 2004, 2008. All rights reserved.
U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.