Deploying secured applications
Before you perform this task, verify that you have already designed, developed and assembled an application with all the relevant security configurations. For more information on these tasks refer to the Designing and developing secured applications and Assembling secured applications articles. In this context, deploying and installing an application are considered the same task.
Deploying applications that have security constraints (secured applications) is not much different than deploying applications any security constraints. The only difference is that you might need to assign users and groups to roles for a secured application, which requires that you have the correct active registry. To deploy a newly secured application click Applications > Install New Application in the navigation panel on the left and follow the prompts. If you are installing a secured application, roles would have been defined in the application. If delegation was required in the application, RunAs roles also are defined.
One of the steps required to deploy secured applications is to assign users and groups to roles defined in the application. This task is completed as part of the step titled Map security roles to users and groups. This assignment might have already been done through the Application Assembly Tool (AAT). In that case you can confirm the mapping by going through this step. One can add new users and groups and modify existing information during this step.
If the applications support delegation, then a RunAs role is already defined in the application. If the delegation policy is set to Specified Identity (during assembly) the intermediary invokes a method using an identity setup during deployment. Use the RunAs role to specify the identity under which the downstream invocations are made. For example, if the RunAs role is assigned user "bob" and the client "alice" is invoking a servlet, with delegation set, which in turn calls the enterprise beans, then the method on the enterprise beans is invoked with "bob" as the identity. As part of the deployment process one of the steps is to assign or modify users to the RunAs roles. This step is titled "Map RunAs roles to users". Use this step to assign new users or modify existing users to RunAs roles when the delegation policy is set to Specified Identity. These steps are common for both installing an application and modifying an existing application. If the application contains roles, you see the "Map security roles to users and groups" link during application installation and also during managing applications, as a link in the Additional Properties section.
- Click Applications > Install New Application. Complete the steps (non-security related) required prior to the step titled Map security roles to users/groups.
- Map security roles to users and groups.
- Map users to RunAs roles if RunAs roles exist in the application.
- Click Correct use of System Identity to specify RunAs roles if needed. Complete this action if the application has delegation set to use System Identity (applicable to enterprise beans only). System Identity uses the WebSphere Application Server security server ID to invoke downstream methods and should be used with caution as this ID has more privileges than other identities in terms of accessing WebSphere Application Server internal methods. This task is provided to make sure that the deployer is aware that the methods listed in the panel have System Identity set up for delegation and to correct them if necessary. If no changes are necessary, skip this task.
- Complete the remaining (non-security related) steps to finish installing and deploying the application.
What to do next
Once a secured application is deployed, verify that you can access the resources in the application with the correct credentials. For example, if your application has a protected Web module, make sure you only use the users listed in the roles for that Web resource to access.
Role-based authorization
Delegations
Assembling secured applications
Configure global security
Assigning users to RunAs roles
Security role to user and group selections
Security permissions assembly settings
WebSphere is a trademark of the IBM Corporation in the United States, other countries, or both.
IBM is a trademark of the IBM Corporation in the United States, other countries, or both.