Admin roles - WAS 6.x

Admin roles

The J2EE role-based authorization concept has been extended to protect the WAS administrative subsystem. A number of administrative roles have been defined to provide degrees of authority needed to perform certain WebSphere administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when global security is enabled. The following table describes the admin roles:
Admin roles

Role Description
monitor Least privileged that basically allows a user to view the WAS configuration and current state.
configurator Monitor privilege plus the ability to change the WAS configuration.
operator Monitor privilege plus the ability to change runtime state, such as starting or stopping services for example.
administrator Operator and configurator privilege, plus additional privileges granted solely to the administrator role. Examples include:

Modifying the server user ID and password
Mapping users and groups to the administrator role

The server ID specified when enabling global security is automatically mapped to the administrator role. Users, groups, can be added or removed from the admin roles from the WAS administrative console at anytime. However, a server restart is required for the changes to take effect. A best practice is to map a group or groups, rather than specific users, to admin roles because it is more flexible and easier to administer in the long run. By mapping a group to an admin role, adding or removing users to or from the group occurs outside of WAS and does not require a server restart for the change to take effect.
In addition to mapping user or groups, a special-subject can also be mapped to the admin roles. A special-subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the admin role ensures that the user making the request has at least been authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.

Related Tasks

Assigning users to naming roles

Role	Description
monitor	Least privileged that basically allows a user to view the WAS configuration and current state.
configurator	Monitor privilege plus the ability to change the WAS configuration.
operator	Monitor privilege plus the ability to change runtime state, such as starting or stopping services for example.
administrator	Operator and configurator privilege, plus additional privileges granted solely to the administrator role. Examples include: Modifying the server user ID and password Mapping users and groups to the administrator role